Read the docs
TI-2021-15833 Aliases CVE-2021-38153GHSA-3j6g-hxx5-3q26

Timing Attack Vulnerability for Apache Kafka Connect and Clients

Priority LOW 36CWE-203Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 9 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-203.

Summary

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

Why it matters now

EPSS 0.06201 93rd percentileScored 2026-11-07
Fix Partial org.apache.kafka:kafka_2.12 (Maven): 2.6.3, 2.7.2, 2.8.1org.apache.kafka:kafka_2.13 (Maven): 2.6.3, 2.7.2, 2.8.1+1 more productRed Hat: 9 advisoriesRed Hat: 9 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache KafkaApache Kafka 2.0.x – 2.0.1; Apache Kafka 2.1.x – 2.1.1; Apache Kafka 2.2.x – 2.2.2; Apache Kafka 2.3.x – 2.3.1; Apache Kafka 2.4.x – 2.4.1; Apache Kafka 2.5.x – 2.5.1; Apache Kafka 2.6.x – 2.6.2; Apache Kafka 2.7.x – 2.7.1; Apache Kafka 2.8.x – 2.8.0—No fix listedCNA
—org.apache.kafka:kafka_2.11 (Maven)2.0.0 – 2.4.1—No fix listedGHSA-3j6g-hxx5-3q26
—org.apache.kafka:kafka_2.12 (Maven)2.0.0 to before 2.6.32.6.3Patch availableGHSA-3j6g-hxx5-3q26
—org.apache.kafka:kafka_2.12 (Maven)2.7.0 to before 2.7.22.7.2Patch availableGHSA-3j6g-hxx5-3q26
—org.apache.kafka:kafka_2.12 (Maven)2.8.0 to before 2.8.12.8.1Patch availableGHSA-3j6g-hxx5-3q26
—org.apache.kafka:kafka_2.13 (Maven)2.4.0 to before 2.6.32.6.3Patch availableGHSA-3j6g-hxx5-3q26
—org.apache.kafka:kafka_2.13 (Maven)2.7.0 to before 2.7.22.7.2Patch availableGHSA-3j6g-hxx5-3q26
—org.apache.kafka:kafka_2.13 (Maven)2.8.0 to before 2.8.12.8.1Patch availableGHSA-3j6g-hxx5-3q26
—org.apache.kafka:kafka-clients (Maven)2.0.0 to before 2.6.32.6.3Patch availableGHSA-3j6g-hxx5-3q26
—org.apache.kafka:kafka-clients (Maven)2.7.0 to before 2.7.22.7.2Patch availableGHSA-3j6g-hxx5-3q26
—org.apache.kafka:kafka-clients (Maven)2.8.0 to before 2.8.12.8.1Patch availableGHSA-3j6g-hxx5-3q26
  • Apache Kafka VendorApache Affected Apache Kafka 2.0.x – 2.0.1; Apache Kafka 2.1.x – 2.1.1; Apache Kafka 2.2.x – 2.2.2; Apache Kafka 2.3.x – 2.3.1; Apache Kafka 2.4.x – 2.4.1; Apache Kafka 2.5.x – 2.5.1; Apache Kafka 2.6.x – 2.6.2; Apache Kafka 2.7.x – 2.7.1; Apache Kafka 2.8.x – 2.8.0 Fixed in — No fix listed CNA
  • org.apache.kafka:kafka_2.11 (Maven) Vendor— Affected 2.0.0 – 2.4.1 Fixed in — No fix listed GHSA-3j6g-hxx5-3q26
  • org.apache.kafka:kafka_2.12 (Maven) Vendor— Affected 2.0.0 to before 2.6.3 Fixed in 2.6.3 Patch available GHSA-3j6g-hxx5-3q26
  • org.apache.kafka:kafka_2.12 (Maven) Vendor— Affected 2.7.0 to before 2.7.2 Fixed in 2.7.2 Patch available GHSA-3j6g-hxx5-3q26
  • org.apache.kafka:kafka_2.12 (Maven) Vendor— Affected 2.8.0 to before 2.8.1 Fixed in 2.8.1 Patch available GHSA-3j6g-hxx5-3q26
  • org.apache.kafka:kafka_2.13 (Maven) Vendor— Affected 2.4.0 to before 2.6.3 Fixed in 2.6.3 Patch available GHSA-3j6g-hxx5-3q26
  • org.apache.kafka:kafka_2.13 (Maven) Vendor— Affected 2.7.0 to before 2.7.2 Fixed in 2.7.2 Patch available GHSA-3j6g-hxx5-3q26
  • org.apache.kafka:kafka_2.13 (Maven) Vendor— Affected 2.8.0 to before 2.8.1 Fixed in 2.8.1 Patch available GHSA-3j6g-hxx5-3q26
  • org.apache.kafka:kafka-clients (Maven) Vendor— Affected 2.0.0 to before 2.6.3 Fixed in 2.6.3 Patch available GHSA-3j6g-hxx5-3q26
  • org.apache.kafka:kafka-clients (Maven) Vendor— Affected 2.7.0 to before 2.7.2 Fixed in 2.7.2 Patch available GHSA-3j6g-hxx5-3q26
  • org.apache.kafka:kafka-clients (Maven) Vendor— Affected 2.8.0 to before 2.8.1 Fixed in 2.8.1 Patch available GHSA-3j6g-hxx5-3q26

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*2.0.0 to before 2.6.3; 2.7.0 to before 2.7.2VulnerableApache
cpe:2.3:a:apache:kafka:2.8.0:-:*:*:*:*:*:*2.8.0VulnerableApache
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 2.2.4Vulnerablequarkusio
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:*before 12.0.0.4.6VulnerableOracle
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:*12.0.0.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*8.0.6.0 – 8.0.9.0; 8.1.0.0.0 – 8.1.20VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*8.0.6.0.0 – 8.0.8.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*8.1.1.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*8.1.1.1VulnerableOracle
  • cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.6.3; 2.7.0 to before 2.7.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:kafka:2.8.0:-:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Apache
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.2.4 Vulnerable ·quarkusio
  • cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:* Versions before 12.0.0.4.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:* Versions 12.0.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.6.0 – 8.0.9.0; 8.1.0.0.0 – 8.1.20 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:* Versions 8.0.6.0.0 – 8.0.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:* Versions 8.1.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:* Versions 8.1.1.1 Vulnerable ·Oracle
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*8.1.2.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.1:*:*:*:*:*:*:*8.0.7.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2:*:*:*:*:*:*:*8.0.7.2VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.0:*:*:*:*:*:*:*8.0.8.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1:*:*:*:*:*:*:*8.0.8.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*8.1.1.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*8.1.1.1VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*20.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*21.12VulnerableOracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:* Versions 8.1.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.1:*:*:*:*:*:*:* Versions 8.0.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2:*:*:*:*:*:*:* Versions 8.0.7.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.0:*:*:*:*:*:*:* Versions 8.0.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1:*:*:*:*:*:*:* Versions 8.0.8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:* Versions 8.1.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:* Versions 8.1.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* Versions 21.12 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-3j6g-hxx5-3q26 org.apache.kafka:kafka_2.12 (Maven) Fixed in 2.6.3 Advisory →
  • Fix · GHSA-3j6g-hxx5-3q26 org.apache.kafka:kafka_2.12 (Maven) Fixed in 2.7.2 Advisory →
  • Fix · GHSA-3j6g-hxx5-3q26 org.apache.kafka:kafka_2.12 (Maven) Fixed in 2.8.1 Advisory →
  • Fix · GHSA-3j6g-hxx5-3q26 org.apache.kafka:kafka_2.13 (Maven) Fixed in 2.6.3 Advisory →
  • Fix · GHSA-3j6g-hxx5-3q26 org.apache.kafka:kafka_2.13 (Maven) Fixed in 2.7.2 Advisory →
  • Fix · GHSA-3j6g-hxx5-3q26 org.apache.kafka:kafka_2.13 (Maven) Fixed in 2.8.1 Advisory →
  • Fix · GHSA-3j6g-hxx5-3q26 org.apache.kafka:kafka-clients (Maven) Fixed in 2.6.3 Advisory →
  • Fix · GHSA-3j6g-hxx5-3q26 org.apache.kafka:kafka-clients (Maven) Fixed in 2.7.2 Advisory →
  • Fix · GHSA-3j6g-hxx5-3q26 org.apache.kafka:kafka-clients (Maven) Fixed in 2.8.1 Advisory →

Red Hat 9 advisories

  • RHSA-2022:6407 Released 2022-09-09 · Red Hat rating Moderate
    Red Hat Integration Camel-K 1.8 security update
    • RHAF Camel-K 1.8
  • RHSA-2022:5606 Released 2022-07-19 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus 2.7 security update
    • RHINT Camel-Q 2.7
  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11
Show 6 more Red Hat advisories
  • RHSA-2022:2232 Released 2022-05-12 · Red Hat rating Moderate
    Red Hat Data Grid 8.3.1 security update
    • Red Hat Data Grid 8.3.1
  • RHSA-2022:0737 Released 2022-03-31 · Red Hat rating Moderate
    Red Hat build of Eclipse Vert.x 4.2.5 security update
    • Vert.x 4.2.5
  • RHSA-2022:0589 Released 2022-02-21 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.2.5 release and security update
    • Red Hat build of Quarkus 2.2.5
  • RHSA-2022:0501 Released 2022-02-09 · Red Hat rating Moderate
    Red Hat Integration - Service Registry release and security update [2.0.3.GA]
    • RHINT Service Registry 2.0.3 GA
  • RHSA-2022:0219 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat AMQ Streams 1.6.6 release and security update
    • Red Hat AMQ Streams 1.6.6
  • RHSA-2022:0138 Released 2022-01-13 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.0.0 release and security update
    • Red Hat AMQ Streams 2.0.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat Integration Service RegistryAffectedNo fix yet
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix yet
Red Hat build of QuarkusAffectedNo fix yet
streams for Apache KafkaAffectedNo fix yet
RHAF Camel-K 1.8Fixed RHSA-2022:6407
RHINT Camel-Q 2.7Fixed RHSA-2022:5606
RHINT Service Registry 2.0.3 GAFixed RHSA-2022:0501
Red Hat AMQ Streams 1.6.6Fixed RHSA-2022:0219
Red Hat AMQ Streams 2.0.0Fixed RHSA-2022:0138
Red Hat Data Grid 8.3.1Fixed RHSA-2022:2232
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Red Hat build of Quarkus 2.2.5Fixed RHSA-2022:0589
Vert.x 4.2.5Fixed RHSA-2022:0737
Not affected: 2 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-38153
  2. 2026-10-03 Alias added: GHSA-3j6g-hxx5-3q26

References

Patch 1

Advisory 4

Other 16

  • TI-2025-20589 Apache Kafka Client: Arbitrary file read and SSRF vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-25947 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication CVSS 3.1CRITICAL 9.1
  • TI-2018-12295 Improper input validation in Apache Kafka CVSS 3.0HIGH 8.8
  • TI-2025-20590 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration CVSS 3.1HIGH 8.8
  • TI-2022-15706 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers CVSS 3.1HIGH 7.5
  • TI-2025-20591 Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences