Medium
Security advisory
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-38153
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:05 UTC · Revision 1
Source evidence
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
osv:CVE-2021-38153
Complete source record
{
"id": "dca771d4cfe627e16dfa854b0a75aa507e397a98746e74b7e027ebb0b8e44542",
"url": "https://osv.dev/vulnerability/CVE-2021-38153",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-38153",
"summary": "Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.",
"evidence": "osv:CVE-2021-38153",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-38153",
"aliases": [
"BIT-kafka-2021-38153",
"CVE-2021-38153",
"GHSA-3j6g-hxx5-3q26"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/kafka",
"type": "GIT",
"events": [
{
"introduced": "3402a8361b7347326b8a9fdb22300986fbbf9cd0"
},
{
"fixed": "c24cbd3f5eeffa1e37a26de37a85d1fb72cdada6"
},
{
"introduced": "448719dc99a19793d55aaaa8b64282ed3fb3197d"
},
{
"fixed": "37a1cc36bf4d76f3fbfed5dabaa6115302bda597"
},
{
"introduced": "ebb1d6e21cc9213071ee1c6a15ec3411fc215b81"
},
{
"last_affected": "ebb1d6e21cc9213071ee1c6a15ec3411fc215b81"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.6.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:kafka:2.8.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "2.8.0-NA"
},
{
"last_affected": "2.8.0-NA"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.8.0-NA",
"2.8.0-rc2",
"2.8.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38153.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/quarkusio/quarkus",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d0ffa05fe8b8fb258d6c177ff0427dd71d7d5210"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.2.4"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38153.json"
}
}
],
"modified": "2026-10-24T10:30:35.034542006Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3E",
"https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3E",
"https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E",
"https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3E",
"https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3E",
"https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3E",
"https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3E",
"https://kafka.apache.org/cve-list",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://www.oracle.com/security-alerts/cpujul2022.html",
"https://www.oracle.com/security-alerts/cpuapr2022.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_brm_-_elastic_charging_engine",
"extracted_events": [
{
"range": [
{
"fixed": "12.0.0.4.6"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:financial_services_analytical_applications_infrastructure",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.6.0"
},
{
"last_affected": "8.0.9.0"
},
{
"introduced": "8.1.0.0.0"
},
{
"last_affected": "8.1.20"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:financial_services_behavior_detection_platform",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.6.0.0"
},
{
"last_affected": "8.0.8.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_brm_-_elastic_charging_engine",
"extracted_events": [
{
"range": [
{
"introduced": "12.0.0.5.0"
},
{
"last_affected": "12.0.0.5.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_policy",
"extracted_events": [
{
"range": [
{
"introduced": "1.15.0"
},
{
"last_affected": "1.15.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:financial_services_behavior_detection_platform",
"extracted_events": [
{
"range": [
{
"introduced": "8.1.1.0"
},
{
"last_affected": "8.1.1.0"
},
{
"introduced": "8.1.1.1"
},
{
"last_affected": "8.1.1.1"
},
{
"introduced": "8.1.2.0"
},
{
"last_affected": "8.1.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:financial_services_enterprise_case_management",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.7.1"
},
{
"last_affected": "8.0.7.1"
},
{
"introduced": "8.0.7.2"
},
{
"last_affected": "8.0.7.2"
},
{
"introduced": "8.0.8.0"
},
{
"last_affected": "8.0.8.0"
},
{
"introduced": "8.0.8.1"
},
{
"last_affected": "8.0.8.1"
},
{
"introduced": "8.1.1.0"
},
{
"last_affected": "8.1.1.0"
},
{
"introduced": "8.1.1.1"
},
{
"last_affected": "8.1.1.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:primavera_unifier",
"extracted_events": [
{
"range": [
{
"introduced": "18.8"
},
{
"last_affected": "18.8"
},
{
"introduced": "19.12"
},
{
"last_affected": "19.12"
},
{
"introduced": "20.12"
},
{
"last_affected": "20.12"
},
{
"introduced": "21.12"
},
{
"last_affected": "21.12"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-38153",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 433662,
"published_at": "2021-09-22T09:15:07.847+00:00"
}