CVE-2026-10143 Overview
CVE-2026-10143 is a denial-of-service vulnerability in kafka-python versions prior to 2.3.2. The flaw resides in the Salted Challenge Response Authentication Mechanism (SCRAM) handling code in scram.py. A malicious or machine-in-the-middle (MITM) broker can supply an excessively large SCRAM iteration count, which the client passes directly to hashlib.pbkdf2_hmac() without validation. The resulting computation freezes the client event loop, blocking producer sends, consumer polls, admin operations, and heartbeats. Affected clients suffer consumer group eviction and repeated reconnect failures, disrupting Kafka-dependent pipelines and applications.
Critical Impact
A broker-controlled iteration count triggers an unbounded pbkdf2_hmac computation that stalls Kafka client operations and causes cascading failures across producers, consumers, and admin clients.
Affected Products
- kafka-python versions prior to 2.3.2
- Python applications using kafka-python with SCRAM-SHA-256 or SCRAM-SHA-512 authentication
- Kafka producers, consumers, and admin clients relying on SCRAM authentication
Discovery Timeline
- 2026-06-10 - CVE-2026-10143 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-10143
Vulnerability Analysis
The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption. SCRAM authentication negotiates a shared secret using a key derivation function (KDF). The client and broker exchange messages that include a salt and an iteration count used by PBKDF2 to derive the salted password. In kafka-python, ScramClient.process_server_first_message() parses the server-first message and forwards the broker-supplied iteration count to hashlib.pbkdf2_hmac() without enforcing an upper bound. A hostile broker can advertise an iteration count in the billions, causing PBKDF2 to consume CPU for minutes or hours on a single SCRAM exchange.
Root Cause
The root cause is missing input validation on a remote, attacker-controllable parameter. The SCRAM iteration count is treated as trusted broker metadata even though it directly drives a computationally expensive cryptographic primitive. Without a sanity ceiling, the KDF iteration loop becomes an algorithmic complexity attack vector.
Attack Vector
Exploitation requires the ability to act as the Kafka broker the client connects to. This includes a compromised broker, a rogue broker in a misconfigured cluster, or an attacker performing a machine-in-the-middle attack against unauthenticated or improperly TLS-validated connections. After the client initiates SCRAM, the attacker responds with a server-first-message containing a malicious iteration count. The client thread executing pbkdf2_hmac() blocks, preventing heartbeats and triggering consumer group rebalances and reconnect storms.
No verified proof-of-concept code is available. Technical details are described in the VulnCheck Advisory for Kafka-Python and the upstream fixes in GitHub Pull Request #3019 and GitHub Pull Request #3026.
Detection Methods for CVE-2026-10143
Indicators of Compromise
- Kafka client processes showing sustained 100% CPU on a single thread during connection establishment to a broker.
- Repeated consumer group rebalances and MemberId eviction events on brokers correlated with client reconnect attempts.
- SCRAM server-first-message payloads containing iteration counts well above typical values (commonly 4096 to 10000).
- Application logs showing stalled poll(), send(), or admin RPC calls followed by session timeout disconnects.
Detection Strategies
- Inventory Python environments and identify deployments of kafka-python at versions earlier than 2.3.2 using software composition analysis or pip list audits.
- Inspect Kafka broker logs and network captures for SCRAM exchanges advertising abnormally high iteration counts.
- Instrument client applications to log the SCRAM iteration count negotiated during authentication and alert on outliers.
Monitoring Recommendations
- Monitor CPU saturation on Kafka client hosts correlated with SCRAM authentication phases.
- Alert on increased consumer group rebalance frequency and SessionTimeoutException rates.
- Track outbound TLS validation failures and certificate mismatches that could indicate MITM attempts against broker connections.
How to Mitigate CVE-2026-10143
Immediate Actions Required
- Upgrade kafka-python to version 2.3.2 or later across all producer, consumer, and admin client deployments.
- Enforce TLS with strict certificate validation on every Kafka client connection to prevent machine-in-the-middle brokers.
- Restrict broker connectivity to known, authenticated endpoints using network segmentation and firewall allowlists.
- Audit Kafka authentication configurations and rotate SCRAM credentials if a malicious broker exposure is suspected.
Patch Information
The fix is delivered in kafka-python2.3.2. The upstream remediation validates the SCRAM iteration count before passing it to hashlib.pbkdf2_hmac(), rejecting values outside a safe range. See the GitHub Commit Update and the merged GitHub Pull Request #3026 for the corrected logic in scram.py.
Workarounds
- Where upgrading is not immediately possible, switch authentication to mutual TLS (mTLS) and disable SCRAM mechanisms.
- Apply a local patch to scram.py that enforces a maximum iteration count (for example, 100000) in ScramClient.process_server_first_message().
- Isolate Kafka client traffic on dedicated network paths with verified broker identities to remove MITM exposure.
# Upgrade kafka-python to the patched release
pip install --upgrade 'kafka-python>=2.3.2'
# Verify installed version
python -c "import kafka; print(kafka.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
