Vulnerability · Published Jun 10, 2026 · Assigned by VulnCheck
CVE-2026-10143kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py
High 7.5
In plain English
A high-severity uncontrolled resource consumption in kafka-python from Dana Powers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-kafka | no fix listed | DEBIAN-CVE-2026-10143 |
| Debian:13 | python-kafka | no fix listed | DEBIAN-CVE-2026-10143 |
| Debian:14 | python-kafka | 2.0.2-12 | DEBIAN-CVE-2026-10143 |
| PyPI | kafka-python | 2.3.2 | GHSA-2jcm-hq8r-84wx |
| PyPI | kafka-python | 2.3.2 | PYSEC-2026-2191 |
| Ubuntu:22.04:LTS | python-kafka | no fix listed | UBUNTU-CVE-2026-10143 |
| Ubuntu:24.04:LTS | python-kafka | no fix listed | UBUNTU-CVE-2026-10143 |
| Ubuntu:25.10 | python-kafka | no fix listed | UBUNTU-CVE-2026-10143 |
| Ubuntu:26.04:LTS | python-kafka | no fix listed | UBUNTU-CVE-2026-10143 |
| Ubuntu:26.10 | python-kafka | no fix listed | UBUNTU-CVE-2026-10143 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dana Powers | kafka-python | 0 – before 2.3.2 |
Weakness: CWE-400, CWE-606 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/dpkp/kafka-python/pull/3019 issue-tracking
- https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b patch
- https://github.com/dpkp/kafka-python/pull/3026 issue-tracking
- https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py third-party-advisory
- https://access.redhat.com/security/cve/CVE-2026-10143 vdb-entry, x_refsource_REDHAT
- RHBZ#2487722 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10143.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:33683 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30076 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42796 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41066 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28571 vendor-advisory, x_refsource_REDHAT