matrice-common (0.2.1), matrice-compute (>=0.1.162, <=0.1.163) +2 more potentially affected by CVE-2026-10142 via kafka-python (>=2.3.0, <=2.3.1)

kafka-python PYPI version =2.3.0, =0.1.162, =1.1.13, =0.2.5a4, =0.2.6a4 Source cves: CVE-2026-10142 Source advisory: SNYK:PYTHON-KAFKAPYTHON-17327850...

ag-kafka-utils (>=0.1.0, <=0.1.2), ai-flow (0.3.1) +110 more potentially affected by CVE-2026-10142 via kafka-python (>=2.0.0, <=2.2.15)

kafka-python PYPI version =2.0.0, =0.1.0, =2022.9.19, =25.8.14, =3.2.0, =1.1.87, =2.8.0a0, =0.1.12, =0.1.4, =0.0.9, =0.0.3, =0.3.64, =0.3.124 and more Source cves: CVE-2026-10142 Source advisory: SNYK:PYTHON-KAFKAPYTHON-17327850...

Memory Allocation with Excessive Size Value

Overview kafka-python is a Pure Python client for Apache Kafka Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the receivebytes function in the protocol parser. An attacker can exhaust system memory or cause connections to hang by sending a...

CVE-2026-10143

CVE-2026-10143 affects kafka-python prior to 2.3.2. The denial‑of‑service arises from ScramClient.process_server_first_message() passing the broker‑provided SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation in scram.py. This can freeze the client event loop, blocking prod...

CVE-2026-10143 kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.processserverfirstmessage...

CVE-2026-10143

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.processserverfirstmessage...

CVE-2026-10143 kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.processserverfirstmessage...

Unchecked Input for Loop Condition

Overview kafka-python is a Pure Python client for Apache Kafka Affected versions of this package are vulnerable to Unchecked Input for Loop Condition in the SCRAM authentication handling. An attacker can cause the client's event loop to freeze by supplying an excessively large iteration count...

ag-kafka-utils (>=0.1.0, <=0.1.2), ai-flow (0.3.1) +110 more potentially affected by CVE-2026-10143 via kafka-python (>=2.0.0, <=2.2.15)

kafka-python PYPI version =2.0.0, =0.1.0, =2022.9.19, =25.8.14, =3.2.0, =1.1.87, =2.8.0a0, =0.1.12, =0.1.4, =0.0.9, =0.0.3, =0.3.64, =0.3.124 and more Source cves: CVE-2026-10143 Source advisory: SNYK:PYTHON-KAFKAPYTHON-17320566...

matrice-common (0.2.1), matrice-compute (>=0.1.162, <=0.1.163) +2 more potentially affected by CVE-2026-10143 via kafka-python (>=2.3.0, <=2.3.1)

kafka-python PYPI version =2.3.0, =0.1.162, =1.1.13, =0.2.5a4, =0.2.6a4 Source cves: CVE-2026-10143 Source advisory: SNYK:PYTHON-KAFKAPYTHON-17320566...

ag-kafka-utils (>=0.1.0, <=0.1.2), ai-flow (0.3.1) +195 more potentially affected by CVE-2026-10143 via kafka-python (>=0.9.2, <=2.3.1)

kafka-python PYPI version =0.9.2, =0.1.0, =2022.9.19, =0.1.0, =25.8.14, =0.3.1, =3.2.0, =1.1.87, =2.8.0a0, =0.1.12, =0.1.21.1 and more Source cves: CVE-2026-10143 Source advisory: MEND:CVE-2026-10143...

CVE-2026-10143 kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.processserverfirstmessage...

CVE-2026-10143

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.processserverfirstmessage...

CVE-2026-10142 kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame Length

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a...

CVE-2026-10142 kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame Length

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a...

ag-kafka-utils (>=0.1.0, <=0.1.2), ai-flow (0.3.1) +195 more potentially affected by CVE-2026-10142 via kafka-python (>=0.9.2, <=2.3.1)

kafka-python PYPI version =0.9.2, =0.1.0, =2022.9.19, =0.1.0, =25.8.14, =0.3.1, =3.2.0, =1.1.87, =2.8.0a0, =0.1.12, =0.1.21.1 and more Source cves: CVE-2026-10142 Source advisory: MEND:CVE-2026-10142...

CVE-2026-10142

CVE-2026-10142 affects kafka-python prior to 2.3.2. The vulnerability resides in the protocol parser, where an attacker can send a crafted 4-byte frame length via receive_bytes() without bounds validation. This can cause a multi-gigabyte memory allocation or an uncaught ValueError, leaving the co...

CVE-2026-10142

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a...

CVE-2026-10142

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a...

Dana Powers kafka-python Resource Management Error Vulnerability

Kafka-Python is a distributed stream processing engine client library written entirely in Python by Dana Powers. Versions of Kafka-Python prior to 2.3.2 contained a resource management vulnerability. This vulnerability stemmed from the lack of verification of the iteration count during SCRAM...