7.5Alta
CVE-2026-10143kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py
Descripción
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Dana Powers | kafka-python | — | |
| dpkp | kafka-python | < 2.3.2 | |
| quay | 3.10 | — | |
| quay | 3.12 | — | |
| quay | 3.15 | — | |
| quay | 3.16 | — | |
| quay | 3.9 | — | |
| Red Hat | Red Hat Quay 3.10 | all versions | |
| Red Hat | Red Hat Quay 3.12 | all versions | |
| Red Hat | Red Hat Quay 3.15 | all versions | |
| Red Hat | Red Hat Quay 3.16 | all versions | |
| Red Hat | Red Hat Quay 3.9 | all versions |
Referencias y parches
- https://github.com/dpkp/kafka-python/pull/3019 issue-trackingIssue TrackingPatch
- https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b patchPatch
- https://github.com/dpkp/kafka-python/pull/3026 issue-trackingIssue TrackingPatch
- https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py third-party-advisoryPatchThird Party Advisory
- https://access.redhat.com/errata/RHSA-2026:28571
- https://access.redhat.com/errata/RHSA-2026:30076
- https://access.redhat.com/errata/RHSA-2026:33683
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/security/cve/CVE-2026-10143
- https://bugzilla.redhat.com/show_bug.cgi?id=2487722
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10143.json
Coincidencias CPE (NVD) (1)
cpe:2.3:a:dpkp:kafka-python:*:*:*:*:*:python:*:*< 2.3.2