Search Guard versions prior to 21.0 had an timing side channel issue when using the internal user database.
search-guard search guard