VDB
RHSA-2026:48693
RHSA-2026:48693
PUBLISHED
CVSS 8.100000381469727 HIGH
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-cli-rhel9@sha256:c772e3e9d2978ac39219ae68f81724e2c6da19fd31bef109d58b1732b44582e1_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9-operator@sha256:207beaae640c0d6fa4dba9c4f13fd1a75d8f62b4e2475c76446dac6895931e84_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-container-networking-plugins-rhel9@sha256:ad307c434a5da314784d0240a76b2886bede47e1b98f5b4b3686ff34aefafe20_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/network-tools-rhel9@sha256:8d5c1cec95f6f80e54264aca271a2562178490f0c6e8fb2a2ebe0cf5afe07a54_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-authentication-rhel9-operator@sha256:18e85f14876f79a76ab5fe0c6df31de54b43344b86a9351edbabceaeda07ea7b_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-must-gather-rhel9@sha256:552eeed226ba2572ed471d2b7b216c1d2233c7e5323a8c9d0f3d38869f83abf6_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:d4c34cd6862f6bcaa256b918c5a07a7d0b580dc906d00274116e33029477aaab_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-hyperkube-rhel9@sha256:06b8255c2aba17c2c1edb5bcb314b3115ee01086a5198d024028698137f17f16_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9@sha256:bf072c11e597925904d16029c0a9232a9e8435b4d51c3c985a16bb3bc3fb4efc_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-olm-catalogd-rhel9@sha256:372052ee24bf248fe5b429051271ec3dbddecbbca4a3b18fd25b7f697dc9d8c1_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ibm-cloud-controller-manager-rhel9@sha256:04a9cb5c5c0f2d5b5093afe93b394469f89af58214b97029d1efa6b9b2f3f6d4_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-server-rhel9@sha256:a8c07bb0f329fa76997f686810cb0bd93d29501d68af081e661d3e48380c5897_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9@sha256:a16560438401c766acf502eb527026bf31d05ad237d4b8affd8d41ddb61e3f3f_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/volume-data-source-validator-rhel9@sha256:27c6173a7616def38c9b0e7fc93480db196eb91b10900eaed89b7fddc52b3ae6_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-etcd-rhel9-operator@sha256:dc2dd3139581e3abd37c3382a1504ddd2341dbe29d9ef89c36366b35113f1946_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-update-keys-rhel9@sha256:5788e4fe8bb9847d139d3cb956efb3696366836b1db25188423a7d0a6e3447da_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-scheduler-rhel9-operator@sha256:293eb8efd49d97b0cb938ffafa8b7ff6d40bb10f9b8ef303db906c60db3c49a7_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:a69506fb3035255d3fb52dbdc3b531b7825c04536f690fe9e3c5739c2a870b10_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-pd-csi-driver-operator-rhel9@sha256:5a9b268278759641b7f7be4c2d9530887146059403d077d35ceb00b98192cf96_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-service-ca-rhel9-operator@sha256:5eedca02a6160855583c1b54a9d90c18a5710dad6a79fc112a60d25071d6a224_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | *, *, * |
…and 633 more
Timeline
- Aug 4, 2026 CVE Published
- Sep 2, 2026 CVE Updated
- Sep 2, 2026 Distribution Patch
- Sep 2, 2026 Distribution Patch
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:48693 advisory
- https://access.redhat.com/security/cve/CVE-2026-12143 advisory
- https://access.redhat.com/security/cve/CVE-2026-16242 advisory
- https://access.redhat.com/security/cve/CVE-2026-39829 advisory
- https://access.redhat.com/security/cve/CVE-2026-44240 advisory
- https://access.redhat.com/security/cve/CVE-2026-45736 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/cve/CVE-2026-49978 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48693.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488480 issue
- https://www.cve.org/CVERecord?id=CVE-2026-12143 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-12143 advisory
- https://cwe.mitre.org/data/definitions/93.html advisory
- https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435 advisory
- https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229 advisory
- https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045 advisory
- https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx advisory
- https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data advisory
- https://www.npmjs.com/package/form-data advisory
…and 33 more