What’s Vulnerable › Vulnerabilities
CVE-2021-38153: Timing Attack Vulnerability for Apache Kafka Connect and Clients
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 6.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-09-22 · updated 2026-06-17
- Weakness: CWE-203
Description
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
Affected products
- Apache Kafka: from 2.0.0 before 2.6.3; from 2.7.0 before 2.7.2; 2.8.0 — fixed in 2.6.3, 2.7.2
- Oracle Corporation Communications BRM - Elastic Charging Engine: before 12.0.0.4.6; 12.0.0.5.0 — fixed in 12.0.0.4.6
- Oracle Communications Cloud Native Core Policy: 1.15.0
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6.0 through 8.0.9.0; from 8.1.0.0.0 through 8.1.20
- Oracle Corporation Financial Services Behavior Detection Platform: from 8.0.6.0.0 through 8.0.8.0; 8.1.1.0, 8.1.1.1, 8.1.2.0
- Oracle Corporation Oracle Financial Services Enterprise Case Management: 8.0.7.1, 8.0.7.2, 8.0.8.0, 8.0.8.1, 8.1.1.0, 8.1.1.1
- Oracle Corporation Primavera Unifier: 18.8, 19.12, 20.12, 21.12
- quarkusio quarkus: before 2.2.4 — fixed in 2.2.4
How to fix
Upgrade to a fixed version: Apache Kafka 2.6.3, 2.7.2; Oracle Corporation Communications BRM - Elastic Charging Engine 12.0.0.4.6; quarkusio quarkus 2.2.4. Check the vendor advisory for mitigations.
References
- https://kafka.apache.org/cve-list
- https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3E
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://kafka.apache.org/cve-list
Get alerted when CVE-2021-38153 or the next vulnerability affects your stack