Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validation, blocking producer sends, consumer polls, admin operations, and heartbeats, which can cause consumer group eviction and repeated reconnect failures.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
#ALERT CVE-2026-10143 (CVSS 7.5) - kafka-python <2.3.2 vulnerable to DoS via SCRAM auth. Malicious broker can freeze client event loop with excessive iteration count. Upgrade immediately. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/eS9BOh7bKy
Post summary
The tweet announces that kafka‑python versions below 2.3.2 are vulnerable to a DoS attack via SCRAM authentication and urges users to upgrade immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dpkp | kafka-python | - | python | - |