Update dependency kafka-python to v2.3.2 [SECURITY] - #14564

Open

renovate-bot wants to merge 1 commit into

GoogleCloudPlatform:mainfrom

renovate-bot:renovate/pypi-kafka-python-vulnerability

renovate-bot commented Sep 1, 2026

Contributor

This PR contains the following updates:

Package	Change	Age	Confidence
kafka-python (changelog)	`==2.0.6` → `==2.3.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

kafka-python vulnerable to denial of service through an unbounded SCRAM iteration count

CVE-2026-10143 / GHSA-2jcm-hq8r-84wx

More information

Details

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

kafka-python vulnerable to denial of service through an unvalidated protocol frame length

CVE-2026-10142 / GHSA-m3px-q5gj-j9x7

More information

Details

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memory allocation or an uncaught ValueError that leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until restart.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

dpkp/kafka-python (kafka-python)

`v2.3.2`

2.3.2 (Jun 3, 2026)

Fixes

kafka.conn: Improve error handling for sasl authenticate mechanisms
kafka.net: Validate SASL/SCRAM iterations (#3026)
KafkaProtocol: validate network frame size (backport of #3019)
Clear _callbacks/_errbacks list when future is_done to avoid reference cycles (#2891)

`v2.3.1`

Fixes

Fix TaggedFields value encoding; add test coverage (#2725)
Fix zstd multi-frame decompression failure (#2717)
Fix KeyError in KafkaConsumer.committed() (#2710)
Fix VarInt/VarLong encoding; move tests to test/protocol/ (#2706)
Fix Fetcher._fetch_offsets_by_times retry handling (#2833)
Fixes to support integration testing with external KAFKA_URI (#2838)
Minor py2 fixes: consumer integration test; dont pip install python-snappy

`v2.3.0`

CLI

python -m cli interfaces for kafka.admin, kafka.consumer, kafka.producer (#2650)

Producer

KIP-654: Abort transaction with pending data with TransactionAbortedError (#2662)
KafkaProducer: Handle UnknownProducerIdError (#2663)
KIP-467: Augment ProduceResponse error messaging for specific culprit records (#2661)

Consumer

KIP-345: Consumer group static membership (#2625)
KIP-207: Add ListOffsetsRequest v5 / handle OffsetNotAvailableError (#2657)
Fetcher: Add missing argument in debug log (#2665)

AdminClient

KIP-430: Return Authorized Operations in Describe Responses (#2656)
Add send_request() and send_requests() to KafkaAdminClient (#2649)

Maintenance

Remove old/unused kafka.protocol.pickle (#2653)
Switch protocol code to getattr/setattr from dict (#2654)
Drop unused imports (#2651)

Project Infra

Bump github/codeql-action from 3 to 4 (#2678)
Bump actions/setup-python from 5 to 6 (#2674)
Bump actions/setup-java from 4 to 5 (#2673)
Bump actions/checkout from 4 to 5 (#2669)
Bump actions/checkout from 5 to 6 (#2694)
NixOS helpers

`v2.2.20`

2.2.20 (Jun 3, 2026)

Fixes

kafka.conn: Improve error handling for sasl authenticate mechanisms
kafka.net: Validate SASL/SCRAM iterations (#3026)
KafkaProtocol: validate network frame size (backport of #3019)
Clear _callbacks/_errbacks list when future is_done to avoid reference cycles (#2891)

`v2.2.19`

Fixes

Fix TaggedFields value encoding; add test coverage (#2725)
Fix zstd multi-frame decompression failure (#2717)
Fix KeyError in KafkaConsumer.committed() (#2710)
Fix VarInt/VarLong encoding; move tests to test/protocol/ (#2706)
Fix Fetcher._fetch_offsets_by_times retry handling (#2833)
Fixes to support integration testing with external KAFKA_URI (#2838)
Minor py2 fixes: consumer integration test; done pip install python-snappy

`v2.2.18`

Fixes

Add ProducerBatch.lt for heapq (#2698)

`v2.2.17`

Fixes

Add internal poll to consumer.position() (#2696)
Initiate Coordinator Reconnect w/ Backoff from Heartbeat Thread (#2695)

Networking

SOCKS5: support looking up names remotely (jschwartzenberg / #2666)

Documentation

Add transactional_id to KafkaProducer Keyword Arguments docstring

`v2.2.16`

Fixes

Fix thread not waking up when there is still data to be sent (gqmelo / #2670)
Ensure timeout is checked after each fetch position update in Consumer.position() (k61n / #2668)

`v2.2.15`

Fixes

Fix KafkaProducer broken method names (llk89 / #2660)
Fix spelling mistake in KafkaConsumer docs (Xeus-CC / #2659)

`v2.2.14`

Fixes

python2 fixups (#2655)
Fix coordinator lock contention during close() (#2652)

`v2.2.13`

Fixes

Use client.await_ready() to simplify blocking wait and add timeout to admin client (#2648)
Fixup import style in example.py

Documentation

update README kafka version badge to include 4.0

`v2.2.12`

Fixes

Fix construction of final GSSAPI authentication message (#2647)
Avoid RuntimeError on mutated _completed_fetches deque in consumer fetcher (#2646)
Throw exception on invalid bucket type (#2642)

`v2.2.11`

Fixes

Do not ignore metadata response for single topic with error (#2640)
Fix decoding bug in AWS_MSK_IAM mechanism (#2639)
Add synchronized decorator; add lock to subscription state (#2636)
Update build links in documentation (#2634)

`v2.2.10`

Fixes

Set the current host in the SASL configs (#2633)
Fix sasl gssapi plugin: do not rely on client_ctx.complete in auth_bytes() (#2631)

`v2.2.9`

Fixes

Do not reset fetch positions if offset commit fetch times out (#2629)

Logging / Error Messages

More / updated debug logging for coordinator / consumer (#2630)

`v2.2.8`

Fixes

Wait for next heartbeat in thread loop; check for connected coordinator (#2622)
Acquire client lock in heartbeat thread before sending requests (#2620)

Logging / Error Messages

Log all SyncGroupResponse errors as info+
More coordinator / heartbeat logging (#2621)
Fix timeout seconds error message in KafkaProducer (#2627)
Update offset commit error handling; use RebalanceInProgressError if applicable (#2623)

`v2.2.7`

Fixes

Minor Heartbeat updates: catch more exceptions / log configuration / raise KafkaConfigurationError (#2618)

`v2.2.6`

Fixes

Only disable heartbeat thread once at beginning of join-group (#2617)

`v2.2.5`

Fixes

Fix producer busy loop with no pending batches (#2616)
Fixup py27 fetcher test failure

`v2.2.4`

Fixes

Do not reset_generation after RebalanceInProgressError; improve CommitFailed error messages (#2614)
Fix KafkaConsumer.poll() with zero timeout (#2613)
Fix Fetch._reset_offsets_async() KeyError when fetching from multiple nodes (#2612)

`v2.2.3`

Fixes

Ignore leading SECURITY_PROTOCOL:// in bootstrap_servers (#2608)
Only create fetch requests for ready nodes (#2607)

`v2.2.2`

Fixes

Fix lint errors

`v2.2.1`

Fixes

Fix KafkaProducer broken method names (llk89 / #2660)
Fix spelling mistake in KafkaConsumer docs (Xeus-CC / #2659)

`v2.2.0`

KafkaProducer

KIP-98: Add idempotent producer support (#2569)
KIP-98: Transactional Producer (#2587)
KIP-98: Add offsets support to transactional KafkaProducer (#2590)
Prefix producer logs w/ client id and transactional id (#2591)
KAFKA-5429: Ignore produce response if batch was previously aborted
KIP-91: KafkaProducer delivery_timeout_ms
Default retries -> infinite
Expand KafkaProducer docstring w/ idempotent and transactional notes
RecordAccumulator: Use helper method to get/set _tp_locks; get dq with lock in reenqueue()

KafkaConsumer

KIP-98: Add Consumer support for READ_COMMITTED (#2582)
KIP-394: handle MEMBER_ID_REQUIRED error w/ second join group request (#2598)
KAFKA-5078: Defer fetch record exception if iterator has already moved across a valid record
KAFKA-5075: Defer consumer fetcher exception if fetch position has already increased
KAFKA-4937: Batch offset fetches in the Consumer
KAFKA-4547: Avoid resetting paused partitions to committed offsets
KAFKA-6397: Consumer should not block setting positions of unavailable partitions (#2593)

Potentially Breaking Changes (internal)

Rename CorruptRecordException -> CorruptRecordError
Rename Coordinator errors to generic not group (#2585)
Rename ClusterMetadata.add_group_coordinator -> add_coordinator + support txn type
Use SaslAuthenticationFailedError in kafka.conn connection failure; Drop unused AuthenticationFailedError
Remove old/unused errors; reorder; KafkaTimeout -> retriable
Drop log_start_offset from producer RecordMetadata

Internal

MemoryRecords iterator; MemoryRecordsBuilder records() helper
Convert DefaultRecordsBuilder.size_in_bytes to classmethod

Fixes

Resolve datetime deprecation warnings (#2589)
Avoid self refcount in log messages; test thread close on all pythons
Fix client.wakeup() race from producer/sender close
Fix ElectionNotNeededError handling in admin client

Tests

Move integration tests and fixtures to test/integration/; simplify unit fixtures (#2588)
Expand Sender test coverage (#2586)
py2 test fixups
Drop unused KafkaClient import from test_fetcher

`v2.1.6`

Fixes

Only create fetch requests for ready nodes (#2607)

`v2.1.5`

Fixes

Fix python2.7 errors (#2578)

Improvements

Move benchmark scripts to kafka.benchmarks module (#2584)
Use slots for metrics (#2583)
Pass metrics_enabled=False to disable metrics (#2581)
Drop unused kafka.producer.buffer / SimpleBufferPool (#2580)
Raise UnsupportedVersionError from coordinator (#2579)

`v2.1.4`

Fixes

Dont block pending FetchRequests when Metadata update requested (#2576)
Fix MetadataRequest for no topics (#2573)
Send final error byte x01 on Sasl OAuth failure (#2572)
Reset SASL state on disconnect (#2571)
Try import new Sequence before old to avoid DeprecationWarning

Improvements

Update Makefile default to 4.0 broker; add make fixture
Improve connection state logging (#2574)

`v2.1.3`

Fixes

Fix crash when switching to closest compatible api_version in KafkaClient (#2567)
Fix maximum version to send an OffsetFetchRequest in KafkaAdminClient (#2563)
Return empty set from consumer.partitions_for_topic when topic not found (#2556)

Improvements

KIP-511: Use ApiVersions v4 on initial connect w/ client_software_name + version (#2558)
KIP-74: Manage assigned partition order in consumer (#2562)
KIP-70: Auto-commit offsets on consumer.unsubscribe(), defer assignment changes to rejoin (#2560)
Use SubscriptionType to track topics/pattern/user assignment (#2565)
Add optional timeout_ms kwarg to consumer.close() (#2564)
Move ensure_valid_topic_name to kafka.util; use in client and producer (#2561)

Testing

Support KRaft / 4.0 brokers in tests (#2559)
Test older pythons against 4.0 broker

Compatibility

Add python 3.13 to compatibility list

`v2.1.2`

Fixes

Simplify consumer.poll send fetches logic
Fix crc validation in consumer / fetcher
Lazy _unpack_records in PartitionRecords to fix premature fetch offset advance in consumer.poll() (#2555)
Debug log fetch records return; separate offsets update log
Fix Fetcher retriable error handling (#2554)
Use six.add_metaclass for py2/py3 compatible abc (#2551)

Improvements

Add FetchMetrics class; move topic_fetch_metrics inside aggregator
DefaultRecordsBatchBuilder: support empty batch
MemoryRecordsBuilder: support arbitrary offset, skipping offsets
Add record.validate_crc() for v0/v1 crc checks
Remove fetcher message_generator / iterator interface
Add size_in_bytes to ABCRecordBatch and implement for Legacy and Default
Add magic property to ABCRecord and implement for LegacyRecord

`v2.1.1`

Fixes

Fix packaging of 2.1.0 in Fedora: testing requires "pytest-timeout". (#2550)
Improve connection error handling when try_api_versions_check fails all attempts (#2548)
Add lock synchronization to Future success/failure (#2549)
Fix StickyPartitionAssignor encode

`v2.1.0`

Support Kafka Broker 2.1 API Baseline

Add baseline leader_epoch support for ListOffsets v4 / FetchRequest v10 (#2511)
Support OffsetFetch v5 / OffsetCommit v6 (2.1 baseline) (#2505)
Support 2.1 baseline consumer group apis (#2503)
Support FindCoordinatorRequest v2 in consumer and admin client (#2502)
Support ListOffsets v3 in consumer (#2501)
Support Fetch Request/Response v6 in consumer (#2500)
Add support for Metadata Request/Response v7 (#2497)
Implement Incremental Fetch Sessions / KIP-227 (#2508)
Implement client-side connection throttling / KIP-219 (#2510)
Add KafkaClient.api_version(operation) for best available from api_versions (#2495)

Consumer

Timeout coordinator poll / ensure_coordinator_ready / ensure_active_group (#2526)
Add optional timeout_ms kwarg to remaining consumer/coordinator methods (#2544)
Check for coordinator.poll failure in KafkaConsumer
Only mark coordinator dead if connection_delay > 0 (#2530)
Delay group coordinator until after bootstrap (#2539)
KAFKA-4160: Ensure rebalance listener not called with coordinator lock (#1438)
Call default_offset_commit_callback after _maybe_auto_commit_offsets_async (#2546)
Remove legacy/v1 consumer message iterator (#2543)
Log warning when attempting to list offsets for unknown topic/partition (#2540)
Add heartbeat thread id to debug logs on start
Add inner_timeout_ms handler to fetcher; add fallback (#2529)

Producer

KafkaProducer: Flush pending records before close() (#2537)
Raise immediate error on producer.send after close (#2542)
Limit producer close timeout to 1sec in del; use context managers to close in test_producer
Use NullLogger in producer atexit cleanup
Attempt to fix metadata race condition when partitioning in producer.send (#2523)
Remove unused partial KIP-467 implementation (ProduceResponse batch error details) (#2524)

AdminClient

Implement perform leader election (#2536)
Support delete_records (#2535)

Networking

Call ApiVersionsRequest during connection, prior to Sasl Handshake (#2493)
Fake api_versions for old brokers, rename to ApiVersionsRequest, and handle error decoding (#2494)
Debug log when skipping api_versions request with pre-configured api_version
Only refresh metadata if connection fails all dns records (#2532)
Support connections through SOCKS5 proxies (#2531)
Fix OverflowError when connection_max_idle_ms is 0 or inf (#2538)
socket.setblocking for eventlet/gevent compatibility
Support custom per-request timeouts (#2498)
Include request_timeout_ms in request debug log
Support client.poll with future and timeout_ms
mask unused afi var
Debug log if check_version connection attempt fails

SASL Modules

Refactor Sasl authentication with SaslMechanism abstract base class; support SaslAuthenticate (#2515)
Add SSPI (Kerberos for Windows) authentication mechanism (#2521)
Support AWS_MSK_IAM authentication (#2519)
Cleanup sasl mechanism configuration checks; fix gssapi bugs; add sasl_kerberos_name config (#2520)
Move kafka.oauth.AbstractTokenProvider -> kafka.sasl.oauth.AbstractTokenProvider (#2525)

Testing

Bump default python to 3.13 in CI tests (#2541)
Update pytest log_format: use logger instead of filename; add thread id
Improve test_consumer_group::test_group logging before group stabilized (#2534)
Limit test duration to 5mins w/ pytest-timeout
Fix external kafka/zk fixtures for testing (#2533)
Disable zookeeper admin server to avoid port conflicts
Set default pytest log level to debug
test_group: shorter timeout, more logging, more sleep
Cache servers/dist in github actions workflow (#2527)
Remove tox.ini; update testing docs
Use thread-specific client_id in test_group
Fix subprocess log warning; specify timeout_ms kwarg in consumer.poll tests
Only set KAFKA_JVM_PERFORMANCE_OPTS in makefile if unset; add note re: 2.0-2.3 broker testing
Add kafka command to test.fixtures; raise FileNotFoundError if version not installed

Documentation

Improve ClusterMetadata docs re: node_id/broker_id str/int types
Document api_version_auto_timeout_ms default; override in group tests

Fixes

Signal close to metrics expire_loop
Add kafka.util timeout_ms_fn
fixup TopicAuthorizationFailedError construction
Fix lint issues via ruff check (#2522)
Make the "mock" dependency optional (only used in Python < 3.3). (#2518)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          Update dependency kafka-python to v2.3.2 [SECURITY]

b6d4383

renovate-bot requested review from a team as code owners

September 1, 2026 17:41

trusted-contributions-gcf Bot added kokoro:force-run owlbot:run labels

product-auto-label Bot added the samples label

kokoro-team removed the kokoro:force-run label

gemini-code-assist Bot reviewed

View reviewed changes

gemini-code-assist Bot left a comment

Contributor

Code Review

This pull request updates the kafka-python dependency version from 2.0.6 to 2.3.2 in dataflow/snippets/requirements.txt. There are no review comments, and I have no feedback to provide.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

owlbot:run samples