CVE-2026-10143 is a denial-of-service vulnerability in kafka-python before version 2.3.2 related to SCRAM authentication handling. The vulnerability arises because the ScramClient.process_server_first_message() method passes the broker-controlled SCRAM iteration count directly to the hashlib.pbkdf2_hmac() function without validating its size. An attacker controlling or intercepting the broker can supply an excessively large iteration count, causing the client to spend excessive time computing the hash, effectively freezing the event loop. This impacts multiple client operations including producing, consuming, admin tasks, and heartbeats, which can result in consumer group eviction and repeated reconnect attempts.

The vulnerability causes a denial-of-service condition by freezing the kafka-python client event loop. This disrupts normal client operations such as sending messages, polling for messages, performing administrative operations, and maintaining heartbeats. The disruption can lead to consumer group eviction and repeated reconnect failures, impacting availability of Kafka clients using affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The affected versions are kafka-python prior to 2.3.2. Users should upgrade to version 2.3.2 or later once available. Until a patch is confirmed, avoid connecting to untrusted brokers or networks where a man-in-the-middle could manipulate SCRAM iteration counts.