Skip to content
fr Sign in
7.5 High

CVE-2026-10143 kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a…

Description

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.

Affected products and versions

Product Affected versions Fixed in
kafka-python Versions not published
Red Hat Quay 3.12 1781937357 earliest → < 1781937357 1781937357
Red Hat Quay 3.9 1781878070 earliest → < 1781878070 1781878070
Red Hat Quay 3 Versions not published
Red Hat Quay 3.10 1782487717 earliest → < 1782487717 1782487717
Red Hat Quay 3.16 1783955846 earliest → < 1783955846 1783955846
Red Hat Quay 3.1 1782487717 earliest → < 1782487717 1782487717
Red Hat Quay 3.15 1784351966 earliest → < 1784351966 1784351966

References

Timeline

  1. Published
  2. Last modified

Other CVEs of kafka-python

The 2 CVEs of kafka-python →
CVE-2026-10142 kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious… 7.5 High
Track this CVE