kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | kafka-python (PyPI) | before 2.3.2 | 2.3.2 | Patch available | GHSA-2jcm-hq8r-84wx |
- kafka-python (PyPI) Vendor— Affected before 2.3.2 Fixed in 2.3.2 Patch available GHSA-2jcm-hq8r-84wx
Remediation
- Fix · GHSA-2jcm-hq8r-84wx kafka-python (PyPI) Fixed in 2.3.2 Advisory →
Red Hat 7 advisories
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:54395 Released 2026-08-12 · Red Hat rating ImportantRed Hat Quay 3.17.4
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:42796 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.15.6
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
Show 4 more Red Hat advisories
- RHSA-2026:41066 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.16.5
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:33683 Released 2026-06-30 · Red Hat rating ImportantRed Hat Quay 3.10.23
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:30076 Released 2026-06-25 · Red Hat rating ImportantRed Hat Quay 3.12.19
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:28571 Released 2026-06-23 · Red Hat rating ImportantRed Hat Quay 3.9.23
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Dana Powers kafka-python 2.3.2
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-08886 kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame LengthPriority MEDIUM 44
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Quay 3.10 | Fixed | RHSA-2026:33683 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:30076 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:42796 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:41066 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:54395 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:28571 |
Not affected: 7 products
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10143
- 2026-10-03 Alias added: GHSA-2jcm-hq8r-84wx
References
Patch 3
Other 12
- https://github.com/dpkp/kafka-python/commit/74400d7ef1b54ad24d4b8170c23b58d1cab65e4f
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10143.json
- https://github.com/pypa/advisory-database/tree/main/vulns/kafka-python/PYSEC-2026-2191.yaml
- https://github.com/dpkp/kafka-python/releases/tag/2.3.2
- https://github.com/dpkp/kafka-python
- https://bugzilla.redhat.com/show_bug.cgi?id=2487722
- https://access.redhat.com/security/cve/CVE-2026-10143
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:33683
- https://access.redhat.com/errata/RHSA-2026:30076
- https://access.redhat.com/errata/RHSA-2026:28571
More Dpkp Kafka-python vulnerabilities
- TI-2026-08886 kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame Length CVSS 4.0HIGH 8.7
Sources
- CVE-2026-10143 · CVE Program
- CVE-2026-10143 · NVD
- FIRST EPSS
- GHSA-2jcm-hq8r-84wx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-10143 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences