{"id":"CVE-2021-38153","aliases":["BIT-kafka-2021-38153","GHSA-3j6g-hxx5-3q26"],"url":"https://o3.security/vulnerability/CVE-2021-38153","summary":"Observable Discrepancy in Apache Kafka","details":"Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.","published":"2021-09-22T09:15:07.847Z","modified":"2026-08-07T08:12:19.720557110Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.kafka:kafka_2.11","fixedVersion":null},{"ecosystem":"Maven","name":"org.apache.kafka:kafka_2.12","fixedVersion":"2.6.3"},{"ecosystem":"Maven","name":"org.apache.kafka:kafka_2.12","fixedVersion":"2.7.2"},{"ecosystem":"Maven","name":"org.apache.kafka:kafka_2.12","fixedVersion":"2.8.1"},{"ecosystem":"Maven","name":"org.apache.kafka:kafka_2.13","fixedVersion":"2.6.3"},{"ecosystem":"Maven","name":"org.apache.kafka:kafka_2.13","fixedVersion":"2.7.2"},{"ecosystem":"Maven","name":"org.apache.kafka:kafka_2.13","fixedVersion":"2.8.1"},{"ecosystem":"Maven","name":"org.apache.kafka:kafka-clients","fixedVersion":"2.6.3"},{"ecosystem":"Maven","name":"org.apache.kafka:kafka-clients","fixedVersion":"2.7.2"},{"ecosystem":"Maven","name":"org.apache.kafka:kafka-clients","fixedVersion":"2.8.1"}],"fix":null,"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3E"},{"type":"ADVISORY","url":"https://kafka.apache.org/cve-list"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T08:12:19.720557110Z"}}