DEBIAN-CVE-2026-10142

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-10142
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10142.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-10142
Upstream
  • CVE-2026-10142
Published
2026-06-10T22:16:55.350Z
Modified
2026-06-12T23:00:08.638566185Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memory allocation or an uncaught ValueError that leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until restart.

References

Affected packages

Debian:11 / python-kafka

Package

Name
python-kafka
Purl
pkg:deb/debian/python-kafka?arch=source&distro=bullseye

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.1-2
2.0.2-1
2.0.2-2
2.0.2-3
2.0.2-4
2.0.2-5
2.0.2-6
2.0.2-7
2.0.2-8
2.0.2-9
2.0.2-10
2.0.2-11

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10142.json"

Debian:12 / python-kafka

Package

Name
python-kafka
Purl
pkg:deb/debian/python-kafka?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.2-3
2.0.2-4
2.0.2-5
2.0.2-6
2.0.2-7
2.0.2-8
2.0.2-9
2.0.2-10
2.0.2-11

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10142.json"

Debian:13 / python-kafka

Package

Name
python-kafka
Purl
pkg:deb/debian/python-kafka?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.2-9
2.0.2-10
2.0.2-11

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10142.json"

Debian:14 / python-kafka

Package

Name
python-kafka
Purl
pkg:deb/debian/python-kafka?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.2-9
2.0.2-10
2.0.2-11

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10142.json"