Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-10143

kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Dana Powers kafka-python

Default version status: unknown

  • 0 to < 2.3.2affected
pkg:pypi/kafka-python

References