The vulnerability in kafka-python (CVE-2026-10143) arises from improper validation of the SCRAM iteration count in the SCRAM authentication process. Specifically, the ScramClient.process_server_first_message() method passes the broker-controlled iteration count directly to the hashlib.pbkdf2_hmac() function without validation. An attacker controlling or intercepting the broker can supply an excessively large iteration count, causing uncontrolled resource consumption that freezes the client event loop. This denial-of-service condition affects multiple client operations including producing, consuming, admin tasks, and heartbeat signals, which can disrupt consumer group stability and cause repeated reconnection attempts.

This vulnerability results in a denial-of-service condition for kafka-python clients using SCRAM authentication. The client event loop can be frozen, blocking critical operations such as sending messages, polling consumers, performing admin operations, and sending heartbeats. This can cause consumer group eviction and repeated reconnect failures, impacting availability of Kafka clients relying on vulnerable versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisories linked do not explicitly confirm a fix for kafka-python itself but provide related errata for Red Hat products. Users should monitor the official kafka-python project and vendor advisories for an official fix or update to version 2.3.2 or later. Until a fix is applied, avoid connecting to untrusted brokers or networks where a malicious broker could exploit this vulnerability.