Description
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Kafka | Apache Kafka 2.0.x – ≤ 2.0.1, Apache Kafka 2.1.x – ≤ 2.1.1, Apache Kafka 2.2.x – ≤ 2.2.2, Apache Kafka 2.3.x – ≤ 2.3.1, Apache Kafka 2.4.x – ≤ 2.4.1, Apache Kafka 2.5.x – ≤ 2.5.1, Apache Kafka 2.6.x – ≤ 2.6.2, Apache Kafka 2.7.x – ≤ 2.7.1, Apache Kafka 2.8.x – ≤ 2.8.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | kafka | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.kafka:kafka_2.11 | >= 2.0.0, <= 2.4.1 | — | GHSA-3j6g-hxx5-3q26 |
| Maven | org.apache.kafka:kafka_2.12 | >= 2.0.0, < 2.6.3 | 2.6.3 | GHSA-3j6g-hxx5-3q26 |
| Maven | org.apache.kafka:kafka_2.12 | >= 2.7.0, < 2.7.2 | 2.7.2 | GHSA-3j6g-hxx5-3q26 |
| Maven | org.apache.kafka:kafka_2.12 | >= 2.8.0, < 2.8.1 | 2.8.1 | GHSA-3j6g-hxx5-3q26 |
| Maven | org.apache.kafka:kafka_2.13 | >= 2.4.0, < 2.6.3 | 2.6.3 | GHSA-3j6g-hxx5-3q26 |
| Maven | org.apache.kafka:kafka_2.13 | >= 2.7.0, < 2.7.2 | 2.7.2 | GHSA-3j6g-hxx5-3q26 |
| Maven | org.apache.kafka:kafka_2.13 | >= 2.8.0, < 2.8.1 | 2.8.1 | GHSA-3j6g-hxx5-3q26 |
| Maven | org.apache.kafka:kafka-clients | >= 2.0.0, < 2.6.3 | 2.6.3 | GHSA-3j6g-hxx5-3q26 |
| Maven | org.apache.kafka:kafka-clients | >= 2.7.0, < 2.7.2 | 2.7.2 | GHSA-3j6g-hxx5-3q26 |
| Maven | org.apache.kafka:kafka-clients | >= 2.8.0, < 2.8.1 | 2.8.1 | GHSA-3j6g-hxx5-3q26 |
Advisories 2
- WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- WID-SEC-2022-0725 Apache Kafka: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Feb 23, 2023
References
- https://kafka.apache.org/cve-list
- [kafka-dev] 20211007 Re: CVE Back Port? mailing-list
- [kafka-dev] 20211012 [VOTE] 2.6.3 RC0 mailing-list
- [kafka-users] 20211012 [VOTE] 2.6.3 RC0 mailing-list
- [kafka-users] 20211012 [VOTE] 2.7.2 RC0 mailing-list
- [kafka-dev] 20211012 [VOTE] 2.7.2 RC0 mailing-list
- [kafka-users] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0 mailing-list
- [kafka-dev] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0 mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html