CVE-2021-3642

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-05 · updated 2026-06-17
Weakness: CWE-203

Description

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

Affected products

quarkusio quarkus: through 2.1.4
Red Hat build of Quarkus: all versions
RedHat Codeready Studio: 12.0
RedHat Data Grid: 8.0
RedHat Descision Manager: 7.0
RedHat Integration Camel K: all versions
RedHat Integration Camel Quarkus: all versions
Red Hat JBoss EAP: 7.0.0
RedHat Jboss Enterprise Application Platform Expansion Pack: all versions
RedHat Jboss Fuse: 7.0.0
RedHat Openshift Application Runtimes: all versions
RedHat Process Automation: 7.0
RedHat Wildfly Elytron: before 1.10.14; from 1.11.0 before 1.15.5; from 1.16.0 before 1.16.1 — fixed in 1.10.14, 1.15.5, 1.16.1

How to fix

Upgrade to a fixed version: RedHat Wildfly Elytron 1.10.14, 1.15.5, 1.16.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3642 or the next vulnerability affects your stack