Deserialization of untrusted data in Apache Heron
Priority MEDIUM 50CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).
Why it matters now
EPSS 0.04815 92nd percentileScored 2026-11-07
Fix Fixed org.apache.heron:heron-simulator (Maven): 0.20.3-incubating
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache Heron | Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, Release v-0.20.0-incubating | — | No fix listed | CNA |
| — | org.apache.heron:heron-simulator (Maven) | 0.20.0-incubating to before 0.20.3-incubating | 0.20.3-incubating | Patch available | GHSA-hjgm-f7vx-m5g7 |
- Apache Heron Vendor— Affected Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, Release v-0.20.0-incubating Fixed in — No fix listed CNA
- org.apache.heron:heron-simulator (Maven) Vendor— Affected 0.20.0-incubating to before 0.20.3-incubating Fixed in 0.20.3-incubating Patch available GHSA-hjgm-f7vx-m5g7
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:heron:0.20.0-incubating:*:*:*:*:*:*:* | 0.20.0-incubating | Vulnerable | Apache |
| cpe:2.3:a:apache:heron:0.20.1-incubating:-:*:*:*:*:*:* | 0.20.1-incubating | Vulnerable | Apache |
| cpe:2.3:a:apache:heron:0.20.2-incubating:*:*:*:*:*:*:* | 0.20.2-incubating | Vulnerable | Apache |
- cpe:2.3:a:apache:heron:0.20.0-incubating:*:*:*:*:*:*:* Versions 0.20.0-incubating Vulnerable ·Apache
- cpe:2.3:a:apache:heron:0.20.1-incubating:-:*:*:*:*:*:* Versions 0.20.1-incubating Vulnerable ·Apache
- cpe:2.3:a:apache:heron:0.20.2-incubating:*:*:*:*:*:*:* Versions 0.20.2-incubating Vulnerable ·Apache
Remediation
- Fix · GHSA-hjgm-f7vx-m5g7 org.apache.heron:heron-simulator (Maven) Fixed in 0.20.3-incubating Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1964
- 2026-10-03 Alias added: GHSA-hjgm-f7vx-m5g7
References
Advisory 2
Other 8
- [ignite-dev] 20200605 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- [ignite-dev] 20200608 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- [ignite-dev] 20200615 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- [ignite-user] 20200615 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- https://lists.apache.org/thread.html/rd43ae18588fd7bdb375be63bc95a651aab319ced6306759e1237ce67@%3Cdev.ignite.apache.org%3E
- https://lists.apache.org/thread.html/re7b43cf8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94@%3Cdev.ignite.apache.org%3E
- https://lists.apache.org/thread.html/re7b43cf8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94@%3Cuser.ignite.apache.org%3E
- https://lists.apache.org/thread.html/rf032a13a4711f88c0a2c0734eecbee1026cc1b6cde27d16a653f8755@%3Cdev.ignite.apache.org%3E
More Apache Heron vulnerabilities
- TI-2021-18532 CRLF log injection CVSS 3.1CRITICAL 9.8
- TI-2018-08446 Path traversal in Apache Incubator Heron CVSS 3.0HIGH 7.5
Sources
- CVE-2020-1964 · CVE Program
- CVE-2020-1964 · NVD
- FIRST EPSS
- GHSA-hjgm-f7vx-m5g7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences