VDB
RHSA-2026:57801
RHSA-2026:57801
PUBLISHED
CVSS 8.5 HIGH
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
Risk Scores
CVSS 3.1
8.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-gcp-pd-csi-driver-operator-rhel9@sha256:bcc1a150b1111aa0843449edfb77a64d27841a065cd17c6d54419fe1c212ed53_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel9@sha256:ba3bf3832c42326b6e15b8589cdc5be81bbd59405e89cd17a453818aeed2452e_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-nfs-rhel9@sha256:382430fe855c8b85db93e9a31370d14fc7b87a7b1e8a0fa4c375c59f382e19b8_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-alertmanager-rhel9@sha256:b2ddf0d54bc7b937d218613000d0c1af6c54caf55bfcbdbcdf540d2993034f10_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel9@sha256:0277786eddf94d3850f2dbacf574b049bd08ed64997fdaf91d8057877c0edeb3_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel9@sha256:664a23c2fe4e2f2b1f7cad977c8fe4235e78248747c91b29c3fb5dd03c4ca79e_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel9@sha256:da96a5c23958795b8173034de26e8f9aceeb0df5ae861042d77a8059e2004c3d_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-workload-identity-federation-webhook-rhel9@sha256:cc2a82f13bd23fcb4dfce3481eff137a8a81190b8d0a2e786888b8e2e97b31a3_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-update-keys-rhel9@sha256:932b722294412b6e3ad3f52d8e562948e8e4e356e06e4d7760446860e87f85ce_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:72652b7e1de51f31f5daa096c42624ed0e444191b9313f728e965352a53dc2fb_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:0b5049c72c510f69aa0599255a7d4b045e604a607673cf9c225b27606d99ae45_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator@sha256:b7c88e59289aeceb8bd3c822e41f8656542e8cc1743e7901f7030ca28fede562_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-config-rhel9-operator@sha256:ebeed3bcb2951a012cf1418c602a71baab336d8f2b6cb7beca48c9986ae46e92_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-must-gather-rhel9@sha256:f955d818d01c60852eec1eb606058706df686246768bcd6f0f6a429ecc10a86a_s390x as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cluster-api-controllers-rhel9@sha256:39dd4669307432ad3dd86cf160c8326f8b6fb0ddf0c117b5068e272e66408f47_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel9@sha256:750d2c9254ab0acd780909b02c0fe317983e23b5f8c34ed8726cebdd298dfecf_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-attacher-rhel9@sha256:43f4f4351ed86d67f9eb02e20195fc73edee225312708417afaa23038ef83acf_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:71438dc8642e05f279e123319c5a9b7269de98a33854615de4a4c3c9325798d2_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-authentication-rhel9-operator@sha256:929c42a94d5f4ce5ac670cf2cd799b53228e8c914ecd54f84dec7265dcda2766_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9@sha256:a9dd26195af0c7681d1ec3095a3266e17223491d851c8b2e0c638aa9011b4262_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
…and 631 more
Timeline
- Aug 25, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:57801 advisory
- https://access.redhat.com/security/cve/CVE-2026-12143 advisory
- https://access.redhat.com/security/cve/CVE-2026-14257 advisory
- https://access.redhat.com/security/cve/CVE-2026-32283 advisory
- https://access.redhat.com/security/cve/CVE-2026-39829 advisory
- https://access.redhat.com/security/cve/CVE-2026-39830 advisory
- https://access.redhat.com/security/cve/CVE-2026-39831 advisory
- https://access.redhat.com/security/cve/CVE-2026-43003 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57801.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488480 issue
- https://www.cve.org/CVERecord?id=CVE-2026-12143 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-12143 advisory
- https://cwe.mitre.org/data/definitions/93.html advisory
- https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435 advisory
- https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229 advisory
- https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045 advisory
- https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx advisory
- https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data advisory
…and 46 more