CVE-2021-42010: Apache Heron

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.

Affected products

• Apache Heron: before 0.20.5-incubating (fixed in 0.20.5-incubating)

Published 2022-10-24. Last modified 2026-06-17.