CVE-2026-10142: kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame Length

Synopsis

A denial-of-service vulnerability exists in the kafka-python protocol parser, affecting all versions before 2.3.2. An unauthenticated attacker reachable over the network, or a machine-in-the-middle positioned between the client and broker, can send a crafted 4-byte frame length value that triggers either a multi-gigabyte memory allocation or an uncaught ValueError, hanging connections and stopping consumer heartbeats until the process is restarted. A patched-image rebuild at version 2.3.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the kafka-python client over the network, either as a reachable broker endpoint or as a machine-in-the-middle on the same network path.

• AuthenticationNot required

  No credentials are needed; the malicious frame can be sent without any prior authentication handshake.

• Victim interactionNot required

  No user or operator action is required; the client processes incoming broker frames automatically.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs to deliver a crafted 4-byte frame length value to the receive_bytes() function.

Blast Radius

• The affected process exhausts available memory by attempting to allocate a multi-gigabyte buffer based on the attacker-controlled frame length value.
• Alternatively, an uncaught ValueError leaves the connection in a permanently broken state without freeing resources.
• Kafka consumers stop sending heartbeats to the broker, causing partition rebalances and message-processing stalls across the consumer group.
• The affected client process must be restarted to recover, interrupting any workload that depends on continuous Kafka consumption or production.