CVE-2026-10143
EUVD-2026-3612810.06.2026, 22:16
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| dpkp | kafka-python | 𝑥 < 2.3.2 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Quay 3.1 | 1782487717 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.12 | 1781937357 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.15 | 1784351966 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.16 | 1783955846 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.9 | 1781878070 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
- CWE-606 - Unchecked Input for Loop ConditionThe product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.