VDB
RHSA-2026:59136
RHSA-2026:59136
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | python3.12-django-ansible-base-0:2.6.20260824-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:2.6.20260824-1.el9ap |
| Red Hat | automation-controller-venv-tower-0:4.7.16-1.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:4.7.16-1.el9ap |
| Red Hat | python3.12-nh3-0:0.3.6-1.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:0.3.6-1.el9ap |
| Red Hat | python3.12-gitpython-0:3.1.59-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:3.1.59-1.el9ap |
| Red Hat | ansible-navigator-0:26.8.0-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:26.8.0-1.el9ap |
| Red Hat | ansible-dev-tools+server-0:26.8.0-1.el10ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10 | 0:26.8.0-1.el10ap |
| Red Hat | ansible-creator-0:26.8.0-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:26.8.0-1.el9ap |
| Red Hat | python-tox-ansible-0:26.8.0-1.el10ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10 | 0:26.8.0-1.el10ap |
| Red Hat | automation-controller-ui-0:4.7.16-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:4.7.16-1.el9ap |
| Red Hat | automation-gateway-server-0:2.6.20260824-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:2.6.20260824-1.el9ap |
| Red Hat | python3.12-aiohttp-0:3.14.3-1.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:3.14.3-1.el9ap |
| Red Hat | ansible-navigator-0:26.8.0-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:26.8.0-1.el9ap |
| Red Hat | automation-gateway-config-0:2.6.20260824-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:2.6.20260824-1.el9ap |
| Red Hat | python3.12-aiohttp-debugsource-0:3.14.3-1.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:3.14.3-1.el9ap |
| Red Hat | python3.12-django-ansible-base+api_documentation-0:2.6.20260824-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:2.6.20260824-1.el9ap |
| Red Hat | python3-django-0:5.2.17-1.el10ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10 | 0:5.2.17-1.el10ap |
| Red Hat | python3.12-aiohttp-0:3.14.3-1.el9ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:3.14.3-1.el9ap |
| Red Hat | ansible-lint-0:26.8.0-1.el10ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10 | 0:26.8.0-1.el10ap |
| Red Hat | ansible-dev-environment-0:26.8.0-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:26.8.0-1.el9ap |
| Red Hat | python3.12-django-ansible-base-0:2.6.20260824-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:2.6.20260824-1.el9ap |
…and 96 more
Timeline
- Aug 24, 2026 CVE Published
- Sep 15, 2026 CVE Updated
- Sep 15, 2026 Distribution Patch
- Sep 15, 2026 Distribution Patch
- Sep 15, 2026 Security Advisory
- Sep 15, 2026 Security Advisory
- Sep 15, 2026 Security Advisory
- Sep 15, 2026 Security Advisory
- Sep 15, 2026 Security Advisory
- Sep 15, 2026 Security Advisory
- Sep 15, 2026 Security Advisory
- Sep 15, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:59136 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates advisory
- https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2456187 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484099 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484377 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2486729 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2487946 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488480 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2500041 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2509975 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2509976 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2510021 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2510032 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2510825 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2510831 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2511095 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2511900 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2511901 issue
…and 103 more