VDB
RHSA-2026:54770
RHSA-2026:54770
PUBLISHED
CVSS 7.400000095367432 HIGH
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-attacher-rhel9@sha256:a40bc6346ba70e36ee3a3b047665d424a080f4e8ad325d2db4f0f425e36e04a9_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9@sha256:45c5530025b68f0f9774955d185a9d7c2ee60e7c36d31edfc218e312002d198c_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-samples-rhel9-operator@sha256:35378bdf2714baa69e9bc250448029ef5d6d24a8417ad95156daeb063bb2840a_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:8347371483f30604b6a0dc65bcd75bcee04837e4375652cccfac70ce02c6dabd_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-apiserver-rhel9@sha256:d22a899c01854ff0b441ed59a63b678cad835609594e458519a0a871c8aac71c_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-docker-builder-rhel9@sha256:6c646ba5910f251f269310fbf7b079b3bc75decc11e455e638eb18bada8f22d2_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator@sha256:6a89f51c91ed98bdd3a6ac044d2a1f15d3b99a113e1f100e69db3a5e92ebdb49_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-route-override-cni-rhel9@sha256:023f4998bbc92993d9d1e76e6cfc950e149131c7005089ace03af350d45ad9ca_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel9@sha256:7b760013d854e881a17f360454c56370fc22c790a7b8c9376f2f5de5796d591c_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/insights-runtime-extractor-rhel9@sha256:b3ef0da0d99a0fba1069916b6012ef922d6c139f6ce6989024be2499cc8f43fb_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:ae17d784b5b85d888273b571e77c2b9974ecbc23fd2a9e057555a4a017852b15_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-rhel9@sha256:2602fee59739b0bfe447cb4a41ea7818c82f29f17d0c5499de7be65cf47b69f4_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-config-reloader-rhel9@sha256:a706941eb63dddb1e25f759e09faada3982f69ce778d62c7aca79ca73b19b846_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-coredns-rhel9@sha256:1e0a003966e2e0f8d617fefb20f864fe3d54c108969d25621544897cb10dc448_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-rhel9-operator@sha256:b7bab80c7ba3d4f19262330dc08a30b3b5327d53e972b50f26e11334c1711026_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-pd-csi-driver-rhel9@sha256:aa5f5d17a1bf9588074b77f3b03222c6c3610921ed91f7816d857a6c734cd122_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-openshift-apiserver-rhel9-operator@sha256:e545d3b9e8a535cb33745851d7c3869dbb23704ed5c98029c294e97f4a90d6da_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-network-metrics-daemon-rhel9@sha256:38b718f7075051360d03a60f65af1cdbef50f541c3eb184eaf8f650127c54d22_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ironic-agent-rhel9@sha256:59096665c7ed7cedc5472be9b3917a1d4a6fc8fd367ac0ee4d0eb0bd819a411e_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:f52a962fba6ec77cc71632f1d29f19c68a88786bfbd28afbdd1ad9bc09bcd2c5_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
…and 636 more
Timeline
- Aug 18, 2026 CVE Published
- Sep 2, 2026 CVE Updated
- Sep 2, 2026 Distribution Patch
- Sep 2, 2026 Distribution Patch
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54770 advisory
- https://access.redhat.com/security/cve/CVE-2026-12143 advisory
- https://access.redhat.com/security/cve/CVE-2026-14362 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-39831 advisory
- https://access.redhat.com/security/cve/CVE-2026-39882 advisory
- https://access.redhat.com/security/cve/CVE-2026-42965 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/cve/CVE-2026-50236 advisory
- https://access.redhat.com/security/cve/CVE-2026-50237 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54770.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488480 issue
- https://www.cve.org/CVERecord?id=CVE-2026-12143 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-12143 advisory
- https://cwe.mitre.org/data/definitions/93.html advisory
- https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435 advisory
- https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229 advisory
- https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045 advisory
- https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx advisory
…and 40 more