RHSA-2026:57013 | Vulnetix

RHSA-2026:57013 PUBLISHED CVSS 8.199999809265137 HIGH

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.

Risk Scores

CVSS 3.1

8.199999809265137

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:b5a54e7c202ccc7836b127a8519ab8a23a5530c97fe84df36db61057fb0a50a3_s390x as a component of Red Hat Openshift Data Foundation 4.20	*
Red Hat	registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:525bbd9528be9ccd5b805e56bd285d72fd7c0345bdc3466b7b998a3500ec4364_s390x as a component of Red Hat Openshift Data Foundation 4.20	*
Red Hat	registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:f5280fc847d46bd0ef5e434e65ff86a68f4d32effce1b01038af2b19cf1911ce_amd64 as a component of Red Hat Openshift Data Foundation 4.2	*
Red Hat	registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:e54149a0e6b64eeed55ebb0a40266decac1c337488adb64b9a34f4c156ceab63_amd64 as a component of Red Hat Openshift Data Foundation 4.2	*
Red Hat	registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:bca244dfe6001e5d68abf5aff64dc1547044f8c1404b39c908a59562ab38b401_arm64 as a component of Red Hat Openshift Data Foundation 4.2	*
Red Hat	registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:8aaf626e3b73199ab5c854f180e76b57061a6cfdaf0b4e7834882e72380bb5ee_ppc64le as a component of Red Hat Openshift Data Foundation 4.20	*
Red Hat	registry.redhat.io/odf4/odf-console-rhel9@sha256:b049f297834a68661194bd662a96ba6aff53431240dde5998057cf82a369cdf6_ppc64le as a component of Red Hat Openshift Data Foundation 4.20	*
Red Hat	Red Hat OpenShift Data Foundation
Red Hat	registry.redhat.io/odf4/ocs-rhel9-operator@sha256:4eae99cd1dd66c3d98bd3cca59f72d70d8d23d295c1db3e3664861d10a914186_s390x as a component of Red Hat Openshift Data Foundation 4.20	*
Red Hat	registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:60caaf10120dd61adba934b8d46a6f4457d161451fe4a0eea8ede8c3d5864de3_ppc64le as a component of Red Hat Openshift Data Foundation 4.20	*
Red Hat	registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:f91b76dc37acdeab2e7b1df28be954586ee1cea4abd2ed476936a54fb55a66c1_amd64 as a component of Red Hat Openshift Data Foundation 4.2	*
Red Hat	registry.redhat.io/odf4/odf-cli-rhel9@sha256:07dc2ce83a19c2c2051e13d7874c36ff51984113162e8f783ff59e403cd6b791_arm64 as a component of Red Hat Openshift Data Foundation 4.2	*
Red Hat	registry.redhat.io/odf4/odr-rhel9-operator@sha256:7c128822dcc99e16890c8c415faf347cb243988a38ff9768ea772d31eebb7a25_amd64 as a component of Red Hat Openshift Data Foundation 4.20	*
Red Hat	registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:e69499da89281c5b4ae67d17d21ca675b3d0f61f7e6ec358ed55db4d662d3b0c_arm64 as a component of Red Hat Openshift Data Foundation 4.20	*
Red Hat	registry.redhat.io/odf4/odf-dependencies-operator-bundle@sha256:3613f888f8b24afa1e9c500ea3a218cdd104c3149bb96511d7caefbd4e1c5a3c_amd64 as a component of Red Hat Openshift Data Foundation 4.2	*
Red Hat	registry.redhat.io/odf4/ocs-rhel9-operator@sha256:68b30fd486e58545561bf9a3e052e1921d6453a0ef71782bb03051b7e90424a3_arm64 as a component of Red Hat Openshift Data Foundation 4.20	*
Red Hat	registry.redhat.io/odf4/cephcsi-rhel9@sha256:97618364f635a8f2fc23a70b9eaf6e3f8b924c581b336a45f5f53681d201d3c5_arm64 as a component of Red Hat Openshift Data Foundation 4.2	*
Red Hat	registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:fea362f3078d23a2240b1976fae2f9db4f4dda35c9252290337adc6f8c298daf_arm64 as a component of Red Hat Openshift Data Foundation 4.2	*
Red Hat	registry.redhat.io/odf4/odf-prometheus-operator-bundle@sha256:d6381a2640d270208255c8ca172e340f5dee08a94a4768265a7dd935fb6272d5_amd64 as a component of Red Hat Openshift Data Foundation 4.20	*
Red Hat	registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:c5c03ea56fd735f790d8a8b607554ae1959aaa3325d4cf7ea17a704fc34d9658_amd64 as a component of Red Hat Openshift Data Foundation 4.2	*

…and 189 more

Timeline

Aug 19, 2026 CVE Published
Sep 24, 2026 CVE Updated
Sep 24, 2026 Distribution Patch
Sep 24, 2026 Distribution Patch
Sep 24, 2026 Security Advisory
Sep 24, 2026 Security Advisory
Sep 24, 2026 Security Advisory
Sep 24, 2026 Security Advisory
Sep 24, 2026 Security Advisory
Sep 24, 2026 Security Advisory
Sep 24, 2026 Security Advisory
Sep 24, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:57013 advisory
https://access.redhat.com/security/cve/CVE-2025-61726 advisory
https://access.redhat.com/security/cve/CVE-2026-12143 advisory
https://access.redhat.com/security/cve/CVE-2026-12151 advisory
https://access.redhat.com/security/cve/CVE-2026-13149 advisory
https://access.redhat.com/security/cve/CVE-2026-13676 advisory
https://access.redhat.com/security/cve/CVE-2026-25681 advisory
https://access.redhat.com/security/cve/CVE-2026-27136 advisory
https://access.redhat.com/security/cve/CVE-2026-33186 advisory
https://access.redhat.com/security/cve/CVE-2026-33747 advisory
https://access.redhat.com/security/cve/CVE-2026-33748 advisory
https://access.redhat.com/security/cve/CVE-2026-34986 advisory
https://access.redhat.com/security/cve/CVE-2026-44740 advisory
https://access.redhat.com/security/cve/CVE-2026-45736 advisory
https://access.redhat.com/security/cve/CVE-2026-48779 advisory
https://access.redhat.com/security/cve/CVE-2026-53488 advisory
https://access.redhat.com/security/cve/CVE-2026-53489 advisory
https://access.redhat.com/security/cve/CVE-2026-53492 advisory
https://access.redhat.com/security/cve/CVE-2026-59869 advisory
https://access.redhat.com/security/cve/CVE-2026-6321 advisory

…and 124 more

Open in Interactive Console →