kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively…
CVSS 4.0HIGH 8.7·Network·No auth·No interaction·EPSS 0.00517·Published 2026-06-10·Fixed in 2.3.2CWE-400
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-…
