Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-10143 kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a…

Description

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.

Produits et versions touchés

Produit Versions touchées Corrigé en
kafka-python Versions non publiées
Red Hat Quay 3.12 1781937357 premières → < 1781937357 1781937357
Red Hat Quay 3.9 1781878070 premières → < 1781878070 1781878070
Red Hat Quay 3 Versions non publiées
Red Hat Quay 3.10 1782487717 premières → < 1782487717 1782487717
Red Hat Quay 3.16 1783955846 premières → < 1783955846 1783955846
Red Hat Quay 3.1 1782487717 premières → < 1782487717 1782487717
Red Hat Quay 3.15 1784351966 premières → < 1784351966 1784351966

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de kafka-python

Les 2 CVE de kafka-python →
CVE-2026-10142 kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious… 7.5 Élevée
Suivre cette CVE