{"id":"CVE-2021-42010","aliases":["EUVD-2022-7061","GHSA-95w5-q9vp-5vrm"],"status":"published","title":"CRLF log injection","description":"Heron versions \u003c= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0176,"percentile":0.78152,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2022-10-24T00:00:00Z","modified":"2026-06-17T04:09:08Z","fixes":[{"ecosystem":"Maven","package":"org.apache.heron:heron-api","fixed_in":["0.20.5-incubating"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.heron:heron-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.5-incubating"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.heron:heron-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.5-incubating"}]}],"versions":["0.20.0-incubating","0.20.1-incubating","0.20.1-incubating-rc2","0.20.3-incubating","0.20.4-incubating","v0.20.1-incubating-rc1"]}],"products":[{"vendor":"apache","product":"heron"},{"vendor":"apache software foundation","product":"apache heron (incubating)"}],"references":[{"url":"https://lists.apache.org/thread/j65nwr8n7jchngwqptzh100drcr4ry2q","tags":["x_transferred","Mailing List","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/10/23/2","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42010","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-95w5-q9vp-5vrm"}],"sources":{"cve":[{"id":"CVE-2021-42010","title":"CRLF log injection","description":"Heron versions \u003c= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.","status":"published","published":"2022-10-24T00:00:00Z","modified":"2025-05-07T15:53:35.603Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:32:58.739039Z"}],"euvd":[{"id":"EUVD-2022-7061","description":"Heron versions \u003c= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.","status":"published","published":"2022-10-24T00:00:00Z","modified":"2025-05-07T15:53:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:53.098709Z"}],"ghsa":[{"id":"GHSA-95w5-q9vp-5vrm","title":"Heron allows CRLF log injection","description":"Heron versions \u003c= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.","status":"published","published":"2022-10-24T19:00:16Z","modified":"2023-08-17T05:02:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:37:00.074932Z"}],"nvd":[{"id":"CVE-2021-42010","description":"Heron versions \u003c= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.","status":"published","published":"2022-10-24T14:15:49.56Z","modified":"2026-06-17T04:09:08.84Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"GHSA-95w5-q9vp-5vrm","title":"Heron allows CRLF log injection","description":"Heron versions \u003c= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.","status":"published","published":"2022-10-24T19:00:16Z","modified":"2024-02-16T08:17:51.474693Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}