CVE-2026-10142

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a...

monasca-notification (>=1.2.0, <=1.2.7), monasca-persister (0.1.12) potentially affected by CVE-2026-10142 via kafka-python (0.9.2)

kafka-python PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - monasca-notification =1.2.0, =1.2.7 - monasca-persister 0.1.12 Source cves: CVE-2026-10142 Source advisory: OSV:PYSEC-2026-2190...

anomalydetection (0.0.0.dev1), productstatus-client (6.5.2) potentially affected by CVE-2026-10142 via kafka-python (1.4.2)

kafka-python PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - anomalydetection 0.0.0.dev1 - productstatus-client 6.5.2 Source cves: CVE-2026-10142 Source advisory: OSV:PYSEC-2026-2190...

PYSEC-2026-2191

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.processserverfirstmessage...

PYSEC-2026-2191

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.processserverfirstmessage...

pipeline-logger (>=1.0.0, <=1.0.2), pipeline-runtime (>=1.0.1, <=1.0.11) +1 more potentially affected by CVE-2026-10142 via kafka-python (1.3.4)

kafka-python PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - pipeline-logger =1.0.0, =1.0.1, =1.0.11 - relayer 2.0.2 Source cves: CVE-2026-10142 Source advisory: OSV:PYSEC-2026-2190...

eazyserver (>=0.2.1, <=0.2.7) potentially affected by CVE-2026-10143 via kafka-python (1.4.4)

kafka-python PYPI version 1.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - eazyserver =0.2.1, =0.2.7 Source cves: CVE-2026-10143 Source advisory: OSV:PYSEC-2026-2191...

ctec-utils (>=0.3.8, <=1.3.0), dataverk (0.2.13) +14 more potentially affected by CVE-2026-10142 via kafka-python (1.4.6)

kafka-python PYPI version 1.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - ctec-utils =0.3.8, =1.0.0, =13.0.0, =11.1.0, =1.0.1, =1.2.5, =1.3.0, =4.3.1, =0.2.1, =0.1.2a47, =0.0.1, =4.1.0, =4.6.0 -...

monasca-notification (>=1.2.0, <=1.2.7), monasca-persister (0.1.12) potentially affected by CVE-2026-10143 via kafka-python (0.9.2)

kafka-python PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - monasca-notification =1.2.0, =1.2.7 - monasca-persister 0.1.12 Source cves: CVE-2026-10143 Source advisory: OSV:PYSEC-2026-2191...

ag-kafka-utils (>=0.1.0, <=0.1.2), ai-flow (0.3.1) +114 more potentially affected by CVE-2026-10143 via kafka-python (>=2.0.0, <=2.3.1)

kafka-python PYPI version =2.0.0, =0.1.0, =2022.9.19, =25.8.14, =3.2.0, =1.1.87, =2.8.0a0, =0.1.12, =0.1.4, =0.0.9, =0.0.3, =0.3.64, =0.3.124 and more Source cves: CVE-2026-10143 Source advisory: OSV:PYSEC-2026-2191...

ag-kafka-utils (>=0.1.0, <=0.1.2), ai-flow (0.3.1) +114 more potentially affected by CVE-2026-10142 via kafka-python (>=2.0.0, <=2.3.1)

kafka-python PYPI version =2.0.0, =0.1.0, =2022.9.19, =25.8.14, =3.2.0, =1.1.87, =2.8.0a0, =0.1.12, =0.1.4, =0.0.9, =0.0.3, =0.3.64, =0.3.124 and more Source cves: CVE-2026-10142 Source advisory: OSV:PYSEC-2026-2190...

eazyserver (>=0.2.1, <=0.2.7) potentially affected by CVE-2026-10142 via kafka-python (1.4.4)

kafka-python PYPI version 1.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - eazyserver =0.2.1, =0.2.7 Source cves: CVE-2026-10142 Source advisory: OSV:PYSEC-2026-2190...

DEBIAN-CVE-2026-10142

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a...

PYSEC-2026-2190

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a...

aiodeu (>=0.1.0, <=0.1.8), convo-nlu (0.1.0) +47 more potentially affected by CVE-2026-10143 via kafka-python (1.4.7)

kafka-python PYPI version 1.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - aiodeu =0.1.0, =0.1.4, =0.2.0, =1.5.0, =0.1.0, =1.1.0, =0.1.0, =0.1.3 - faust-prometheus-monitor 0.1.4 - faust-pydantic-validate 0.0.1 a...

pipeline-logger (>=1.0.0, <=1.0.2), pipeline-runtime (>=1.0.1, <=1.0.11) +1 more potentially affected by CVE-2026-10143 via kafka-python (1.3.4)

kafka-python PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - pipeline-logger =1.0.0, =1.0.1, =1.0.11 - relayer 2.0.2 Source cves: CVE-2026-10143 Source advisory: OSV:PYSEC-2026-2191...

anomalydetection (0.0.0.dev1), productstatus-client (6.5.2) potentially affected by CVE-2026-10143 via kafka-python (1.4.2)

kafka-python PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - anomalydetection 0.0.0.dev1 - productstatus-client 6.5.2 Source cves: CVE-2026-10143 Source advisory: OSV:PYSEC-2026-2191...

aiokafka (0.0.1) potentially affected by CVE-2026-10142 via kafka-python (1.0.1)

kafka-python PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - aiokafka 0.0.1 Source cves: CVE-2026-10142 Source advisory: OSV:PYSEC-2026-2190...

beaver (36.3.1), data-pipeline (>=0.9.5, <=0.9.12) +1 more potentially affected by CVE-2026-10142 via kafka-python (0.9.5)

kafka-python PYPI version 0.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - beaver 36.3.1 - data-pipeline =0.9.5, =0.0.7, =1.3.0 Source cves: CVE-2026-10142 Source advisory: OSV:PYSEC-2026-2190...

UBUNTU-CVE-2026-10142

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a...