The vulnerability in kafka-python (CVE-2026-10143) arises from the lack of validation of the SCRAM iteration count supplied by the broker during authentication. Specifically, the iteration count is passed unchecked to the hashlib.pbkdf2_hmac() function in scram.py, allowing a malicious or man-in-the-middle broker to specify an excessively large iteration count. This causes the client's event loop to freeze, resulting in denial of service by blocking producer sends, consumer polls, admin operations, and heartbeats. The issue affects kafka-python versions prior to 2.3.2. Red Hat's advisory confirms the vulnerability and notes that no effective mitigation or fix meeting their criteria is currently available.

The vulnerability causes a denial-of-service condition by freezing the kafka-python client's event loop during SCRAM authentication. This prevents normal client operations such as message sending, polling for messages, administrative tasks, and heartbeat maintenance. The resulting disruption can lead to consumer group eviction and persistent connection failures, impacting availability of Kafka clients using affected versions.

According to the Red Hat advisory, no mitigation or fix meeting their criteria for ease of use, deployment, applicability, or stability is currently available. Users are advised to upgrade to kafka-python version 2.3.2 or later where the issue is fixed. Until then, no effective mitigation is provided by the vendor or Red Hat.