The vulnerability in kafka-python before version 2.3.2 arises from improper validation of the SCRAM iteration count in the process_server_first_message() function. The broker-controlled iteration count is passed directly to the hashlib.pbkdf2_hmac() function without limits, enabling an attacker controlling the broker or positioned as a man-in-the-middle to cause uncontrolled resource consumption. This results in denial-of-service by freezing the client event loop and disrupting Kafka client operations such as producing, consuming, and maintaining group membership.

This vulnerability can cause denial-of-service conditions for kafka-python clients by freezing the event loop. This disruption affects producer sends, consumer polls, administrative operations, and heartbeat messages. Consequences include consumer group eviction and repeated reconnect failures, which degrade Kafka client availability and reliability. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating exposure by avoiding untrusted brokers or man-in-the-middle scenarios in SCRAM authentication. Monitoring for unusual delays or failures in Kafka client operations may help detect exploitation attempts.