CVE-2021-38153 Timing Attack Vulnerability for Apache Kafka Connect and Clients
Timing attacks on password validation allow attackers to brute force credentials, potentially leading to unauthorized access to Apache Kafka Connect and clients.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-38153?
CVE-2021-38153 is a medium-severity vulnerability in Oracle Communications Cloud Native Core Policy, published on 22 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
Weakness: CWE-203
Which versions are affected by CVE-2021-38153?
21 open source packages ship an affected version, including org.apache.kafka:kafka-clients, kafka and org.apache.kafka:kafka_2.11. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.kafka:kafka-clients Maven | From 2.0.0 | 2.6.3 |
org.apache.kafka:kafka-clients Maven | From 2.0.0 | 2.6.3 |
org.apache.kafka:kafka-clients Maven | From 2.7.0 | 2.7.2 |
org.apache.kafka:kafka-clients Maven | From 2.7.0 | 2.7.2 |
org.apache.kafka:kafka-clients Maven | From 2.8.0 | 2.8.1 |
org.apache.kafka:kafka-clients Maven | From 2.8.0 | 2.8.1 |
15 more packages
kafka Bitnami | From 2.0.0 | 2.6.3, 2.7.2, 2.8.1 |
org.apache.kafka:kafka_2.11 Maven | From 2.0.0 to 2.4.1 | None |
org.apache.kafka:kafka_2.11 Maven | From 2.0.0 to 2.4.1 | None |
org.apache.kafka:kafka_2.12 Maven | From 2.0.0 | 2.6.3 |
org.apache.kafka:kafka_2.12 Maven | From 2.0.0 | 2.6.3 |
org.apache.kafka:kafka_2.12 Maven | From 2.7.0 | 2.7.2 |
org.apache.kafka:kafka_2.12 Maven | From 2.7.0 | 2.7.2 |
org.apache.kafka:kafka_2.12 Maven | From 2.8.0 | 2.8.1 |
org.apache.kafka:kafka_2.12 Maven | From 2.8.0 | 2.8.1 |
org.apache.kafka:kafka_2.13 Maven | From 2.4.0 | 2.6.3 |
org.apache.kafka:kafka_2.13 Maven | From 2.4.0 | 2.6.3 |
org.apache.kafka:kafka_2.13 Maven | From 2.7.0 | 2.7.2 |
org.apache.kafka:kafka_2.13 Maven | From 2.7.0 | 2.7.2 |
org.apache.kafka:kafka_2.13 Maven | From 2.8.0 | 2.8.1 |
org.apache.kafka:kafka_2.13 Maven | From 2.8.0 | 2.8.1 |
Products include Apache Kafka, Oracle Communications Brm - Elastic Charging Engine, Oracle Communications Cloud Native Core Policy, Oracle Financial Services Analytical Applications Infrastructure, Oracle Financial Services Behavior Detection Platform, Oracle Financial Services Enterprise Case Management and 2 more.
How do I fix CVE-2021-38153?
Upgrade org.apache.kafka:kafka-clients to a fixed version for your release line: 2.6.3, 2.7.2 or 2.8.1.
Is CVE-2021-38153 being exploited?
There is no known exploitation of CVE-2021-38153 in the wild and no public exploit code.
Other vulnerabilities in Oracle Communications Cloud Native Core Policy
- CVE-2026-33557 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
- CVE-2025-27818 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration
- CVE-2018-17196 Improper Input Validation in Apache Kafka
- CVE-2026-35554 Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
- CVE-2025-27817 Apache Kafka Client: Arbitrary file read and SSRF vulnerability
All Oracle Communications Cloud Native Core Policy vulnerabilities
Sources
Also known as BIT-kafka-2021-38153, GHSA-3j6g-hxx5-3q26, UBUNTU-CVE-2021-38153.