CVE-2021-38153: Apache Kafka

Medium severity, CVSS 5.9. EPSS: 6.2% chance of exploitation in the next 30 days.

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

Affected products

• Apache Kafka: from 2.0.0, before 2.6.3 (fixed in 2.6.3); from 2.7.0, before 2.7.2 (fixed in 2.7.2); version 2.8.0 only
• Oracle Communications Brm - Elastic Charging Engine: before 12.0.0.4.6 (fixed in 12.0.0.4.6); version 12.0.0.5.0 only
• Oracle Communications Cloud Native Core Policy: version 1.15.0 only
• Oracle Financial Services Analytical Applications Infrastructure: from 8.0.6.0, up to and including 8.0.9.0; from 8.1.0.0.0, up to and including 8.1.20
• Oracle Financial Services Behavior Detection Platform: from 8.0.6.0.0, up to and including 8.0.8.0; version 8.1.1.0 only; version 8.1.1.1 only; version 8.1.2.0 only
• Oracle Financial Services Enterprise Case Management: version 8.0.7.1 only; version 8.0.7.2 only; version 8.0.8.0 only; version 8.0.8.1 only; version 8.1.1.0 only; version 8.1.1.1 only
• Oracle Primavera Unifier: version 18.8 only; version 19.12 only; version 20.12 only; version 21.12 only
• Quarkus Quarkus: before 2.2.4 (fixed in 2.2.4)

Published 2021-09-22. Last modified 2026-06-17.