Version 2.2.3-1 of python-kafka is marked for autoremoval from testing on Wed 25 Nov 2026. It depends (transitively) on python-botocore, affected by #1145153. You should try to prevent the removal by fixing these RC bugs.
vcswatch reports that
there is an error with this package's VCS, or the debian/changelog file inside
it. Please check the error shown below and try to fix it. You might have
to update the VCS URL in the debian/control file to point to the correct
repository.
error: RPC failed; HTTP 500 curl 22 The requested URL returned error: 500
fatal: expected 'acknowledgments'
2 issues left for the package maintainer to handle:
CVE-2026-10142:
(needs triaging)
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memory allocation or an uncaught ValueError that leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until restart.
CVE-2026-10143:
(needs triaging)
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.
Among the 8 debian patches
available in version 2.2.3-1 of the package,
we noticed the following issues:
7 patches
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
Standards version of the package is outdated.
wishlist
The package should be updated to follow the last version of Debian Policy
(Standards-Version 4.7.4 instead of
4.5.0).
![[bug history graph]](https://qa.debian.org/data/bts/graphs/p/python-kafka.png){kind=link}