Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-10T20:22:39 kafka-python: kafka-python: Denial of Service via excessive SCRAM authentication iteration count 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-606

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.

A flaw was found in kafka-python. A malicious or machine-in-the-middle broker could exploit a denial-of-service vulnerability during SCRAM authentication. By providing an excessively large iteration count, the broker can cause the client's event loop to freeze. This prevents critical operations such as sending messages, polling for new messages, and maintaining heartbeats, ultimately leading to consumer group eviction and persistent connection failures.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Quay 3.10 2026-06-30T00:00:00Z RHSA-2026:33683 quay/quay-rhel8:1782487717 Red Hat Quay 3.12 2026-06-25T00:00:00Z RHSA-2026:30076 quay/quay-rhel8:1781937357 Red Hat Quay 3.15 2026-07-21T00:00:00Z RHSA-2026:42796 quay/quay-rhel8:1784351966 Red Hat Quay 3.16 2026-07-16T00:00:00Z RHSA-2026:41066 quay/quay-rhel9:1783955846 Red Hat Quay 3.9 2026-06-23T00:00:00Z RHSA-2026:28571 quay/quay-rhel8:1781878070 https://www.cve.org/CVERecord?id=CVE-2026-10143 https://nvd.nist.gov/vuln/detail/CVE-2026-10143 https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b https://github.com/dpkp/kafka-python/pull/3019 https://github.com/dpkp/kafka-python/pull/3026 https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py