CVE-2026-10143
High
Description
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.
SeverityHigh
CVSS7.5
Exploit probability—
ProductDpkp Kafka-python
PublishedJun 10, 2026
First seenJun 10, 2026
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- dpkp kafka-python2.3.2 or later
- kafka-python2.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dpkp kafka-python | v < 2.3.2 | 2.3.2 |
| kafka-pythonPyPI | v < 2.3.2 | 2.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.