CVE-2021-3642: Quarkus

Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

Affected products

• Quarkus Quarkus: up to and including 2.1.4
• Red Hat Build Of Quarkus: affected versions not specified
• Red Hat Codeready Studio: version 12.0 only
• Red Hat Data Grid: version 8.0 only
• Red Hat Descision Manager: version 7.0 only
• Red Hat Integration Camel K: affected versions not specified
• Red Hat Integration Camel Quarkus: any version
• Red Hat JBoss Enterprise Application Platform: version 7.0.0 only
• Red Hat JBoss Enterprise Application Platform Expansion Pack: affected versions not specified
• Red Hat JBoss Fuse: version 7.0.0 only
• Red Hat Openshift Application Runtimes: affected versions not specified
• Red Hat Process Automation: version 7.0 only
• Red Hat Wildfly Elytron: before 1.10.14 (fixed in 1.10.14); from 1.11.0, before 1.15.5 (fixed in 1.15.5); from 1.16.0, before 1.16.1 (fixed in 1.16.1)

Published 2021-08-05. Last modified 2026-06-17.