CVE-2026-10143 kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py
A malicious broker can cause a denial of service in kafka-python by sending an excessive SCRAM iteration count, freezing the client event loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-10143?
CVE-2026-10143 is a high-severity denial of service vulnerability in Dana Powers kafka-python, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.
Which versions are affected by CVE-2026-10143?
3 open source packages ship an affected version, including kafka-python. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kafka-python PyPI | All versions | 2.3.2 |
kafka-python PyPI | All versions | 2.3.2 |
kafka-python PyPI | All versions | 2.3.2 |
Products include Dpkp Kafka-Python.
How do I fix CVE-2026-10143?
Upgrade kafka-python to 2.3.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-10143 being exploited?
There is no known exploitation of CVE-2026-10143 in the wild and no public exploit code.
Other vulnerabilities in Dana Powers kafka-python
Sources
Also known as DEBIAN-CVE-2026-10143, GHSA-2jcm-hq8r-84wx, PYSEC-2026-2191, UBUNTU-CVE-2026-10143.