Executive Summary

The vulnerability exists in kafka-python versions prior to 2.3.2 within the protocol parser. It allows a malicious broker or a machine-in-the-middle attacker to cause a denial-of-service by sending a specially crafted 4-byte frame length value that lacks proper bounds validation.

This crafted frame length, when processed by the receive_bytes() function, can trigger either a very large memory allocation (multi-gigabyte) or an uncaught ValueError. Both outcomes cause the connection to hang or break, leading to requests stalling and consumers stopping their heartbeats until the application is restarted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing denial-of-service conditions in your kafka-python client applications.

• Memory exhaustion due to large allocations triggered by malicious frame lengths.
• Connections hanging or breaking because of uncaught errors, leading to stalled requests.
• Consumers stopping their heartbeat signals, which can disrupt message consumption until the client is restarted.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0