CVE-2021-38153 Apache Kafka
| Affected software | Apache Kafka |
|---|---|
| Severity | 5.9 Medium CVSS 3.1 2 scores |
| Fixed in | 2.6.3, 2.7.2, 2.8.1 |
| Weakness | CWE-203 |
| Published | 22 Sep 2021 |
| Updated | 17 Jun 2026 |
Description
Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 1 citation · earliest 2023-04-11.
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 6.2% chance in 30 days
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-38153 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | blog.cloudflare.com | /ddos-threat-report-2023-q1 | 2023-04-11 |
Waratek protection
A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.
- Protection none
- Action unverified
- Review automated Inferred
- Record active
| Decided by | The affected package being open source on Maven, so the fix can be read |
|---|---|
| Finding | This CVE affects an open-source Java library published on Maven Central (Maven packages: org.apache.kafka:kafka_2.11, org.apache.kafka:kafka_2.12, org.apache.kafka:kafka_2.13, org.apache.kafka:kafka-clients), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on. |
CVSS
5.9 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
CVSS
5.9 MEDIUM v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Communications Applications / Notifications (Apache Kafka) (Prior to 12.0.0.4.6, Prior to 12.0.0.5.1) |
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Communications / Policy (Apache Kafka) (1.15.0) Oracle Financial Services Applications / Installers (Apache Kafka) (8.0.7.1, 8.0.7.2, 8.0.8.0, 8.0.8.1, 8.1.1.0, 8.1.1.1) Oracle Financial Services Applications / Others (Apache Kafka) (8.0.6.0-8.0.9.0, 8.1.0.0-8.1.2.0) Oracle Financial Services Applications / Third Party (Apache Kafka) (8.0.6.0-8.0.8.0, 8.1.1.0, 8.1.1.1, 8.1.2.0) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Construction and Engineering / Event Streams and Communications (Apache Kafka) (18.8, 19.12, 20.12, 21.12) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Policy (Apache Kafka) | 1.15.0 | 1.15.0 |
| Oracle Communications Applications | Notifications (Apache Kafka) | Prior to 12.0.0.4.6, Prior to 12.0.0.5.1 | |
| Oracle Construction and Engineering | Event Streams and Communications (Apache Kafka) | 18.8, 19.12, 20.12, 21.12 | 18.8 · 19.12 · 20.12 · 21.12 |
| Oracle Financial Services Applications | Installers (Apache Kafka) | 8.0.7.1, 8.0.7.2, 8.0.8.0, 8.0.8.1, 8.1.1.0, 8.1.1.1 | 8.0.7.1 · 8.0.7.2 · 8.0.8.0 · 8.0.8.1 · 8.1.1.0 · 8.1.1.1 |
| Oracle Financial Services Applications | Others (Apache Kafka) | 8.0.6.0-8.0.9.0, 8.1.0.0-8.1.2.0 | |
| Oracle Financial Services Applications | Third Party (Apache Kafka) | 8.0.6.0-8.0.8.0, 8.1.1.0, 8.1.1.1, 8.1.2.0 | 8.1.1.0 · 8.1.1.1 · 8.1.2.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.kafka:kafka_2.11 |
2.0.0 | none | 2.4.1 |
org.apache.kafka:kafka_2.12 |
2.0.0 | 2.6.3 |
unbounded |
org.apache.kafka:kafka_2.12 |
2.7.0 | 2.7.2 |
unbounded |
org.apache.kafka:kafka_2.12 |
2.8.0 | 2.8.1 |
unbounded |
org.apache.kafka:kafka_2.13 |
2.4.0 | 2.6.3 |
unbounded |
org.apache.kafka:kafka_2.13 |
2.7.0 | 2.7.2 |
unbounded |
org.apache.kafka:kafka_2.13 |
2.8.0 | 2.8.1 |
unbounded |
org.apache.kafka:kafka-clients |
2.0.0 | 2.6.3 |
unbounded |
org.apache.kafka:kafka-clients |
2.7.0 | 2.7.2 |
unbounded |
org.apache.kafka:kafka-clients |
2.8.0 | 2.8.1 |
unbounded |
Products and versions
12 products, 33 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | kafka | generic | ≥ 2.0.0 and ＜ 2.6.3 · ≥ 2.7.0 and ＜ 2.7.2 · 2.8.0 |
| nvd | oracle | communications brm - elastic charging engine | generic | ＜ 12.0.0.4.6 · 12.0.0.5.0 |
| nvd | oracle | communications cloud native core policy | generic | 1.15.0 |
| nvd | oracle | financial services analytical applications infrastructure | generic | ≥ 8.0.6.0 and ≤ 8.0.9.0 · ≥ 8.1.0.0.0 and ≤ 8.1.20 |
| nvd | oracle | financial services behavior detection platform | generic | ≥ 8.0.6.0.0 and ≤ 8.0.8.0 · 8.1.1.0 · 8.1.1.1 · 8.1.2.0 |
| nvd | oracle | financial services enterprise case management | generic | 8.0.7.1 · 8.0.7.2 · 8.0.8.0 · 8.0.8.1 · 8.1.1.0 · 8.1.1.1 |
| nvd | oracle | primavera unifier | generic | 18.8 · 19.12 · 20.12 · 21.12 |
| osv | org.apache.kafka | kafka-clients | generic | ≥ 2.0.0 and ＜ 2.6.3 · ≥ 2.7.0 and ＜ 2.7.2 · ≥ 2.8.0 and ＜ 2.8.1 |
| osv | org.apache.kafka | kafka_2.11 | generic | ≥ 2.0.0 and ≤ 2.4.1 |
| osv | org.apache.kafka | kafka_2.12 | generic | ≥ 2.0.0 and ＜ 2.6.3 · ≥ 2.7.0 and ＜ 2.7.2 · ≥ 2.8.0 and ＜ 2.8.1 |
| osv | org.apache.kafka | kafka_2.13 | generic | ≥ 2.4.0 and ＜ 2.6.3 · ≥ 2.7.0 and ＜ 2.7.2 · ≥ 2.8.0 and ＜ 2.8.1 |
| nvd | quarkus | quarkus | generic | ＜ 2.2.4 |
References
Timeline
Timeline
| Published | 2021-09-22 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2023-04-11 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |