VDB
RHSA-2026:60446
RHSA-2026:60446
PUBLISHED
CVSS 7.400000095367432 HIGH
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-kubevirt-cloud-controller-manager-rhel9@sha256:60c4fd0dcbc1ed92bee7dedce7879893a23c9e4a6181e5e6d6a8f04880f377eb_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9@sha256:d5d338daef4ae436780be192907d28a26785021d97865d8a95db9065734061f0_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:37f226136e439a1b37fab44e06ff30eb22b1ba8f12eca9e85f59936c3d58acd1_s390x as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-insights-rhel9-operator@sha256:0d31a90914ea716508caf180e30fb682cdd8066da7a0a31752be9d86ec9c777c_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-server-rhel9@sha256:f12584b95171f442bb3661c908ee43de70d0400c6273eb4e93325a5f3f167b54_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9@sha256:ad2f0cda09211f3e0aff615306168baf808e6fefbf1f039c3ae1a1fa7050a61e_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-marketplace-rhel9@sha256:b78827903e5c338d67a4ea2ba10ee67e16482ff00968ba99c27af2b6d50ce202_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-configmap-reloader-rhel9@sha256:751f007afae9f16527e9039aa95c2ee6efd2ee20afe3c083ba7298493d2406f3_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-samples-rhel9-operator@sha256:5a2653ccd5dc3f59a228ee8b936460575e1a392d12287661b1dc83a9f8210033_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:779afd8e0fa21d022d7e75e7ba8da00cc7604db1adfbbea879bfb1d0f8c9c831_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:50f602354dcb223759d781cb057b4081a424d6a509178b10674358cc8dba41e8_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-haproxy-router-rhel9@sha256:adfe8cb84a5f0a241fe69ec532b7092a10cc274cc3aac2b86f33ac8e725ab2d8_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-config-rhel9-operator@sha256:f2dac4ffbee9d028b26e683b63a9f033ef8609907f6c498d42c447a306e75328_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-deployer-rhel9@sha256:149cca2af3f89c7d1e105de81bbd098c66be5687f18a584b644f21d0be20f414_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-machine-controllers-rhel9@sha256:23b0327190559517a3526d2500534542e9a397210cc6f663ac2b313aee902e92_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:647704923828c83c6ed3810e3c4d7456fcbe378516dabfac30f203a3bd3634b2_s390x as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-cni-microshift-rhel9@sha256:17afd4ebbc2a5233681d4cc1774fcd70dc932bc10006235b11de8dcce826c2ba_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:49f08b645fc28af342483d9efaf2f607c9c2a6b491b477cdcf2985c44aa3e894_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel9@sha256:70f95a8b240afc604ee9af621fc3b63adaf80f593f3131e7ed51077ed2c77a1b_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-route-override-cni-rhel9@sha256:4cb60d36cc3b34b4b1496b74b9b2e68ff152a71d7f957b356311ea811bf05573_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
…and 644 more
Timeline
- Sep 1, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
References
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
- https://access.redhat.com/security/cve/CVE-2026-66138 advisory
- https://access.redhat.com/security/cve/CVE-2026-73086 advisory
- https://access.redhat.com/security/cve/CVE-2026-73566 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60446.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488480 issue
- https://www.cve.org/CVERecord?id=CVE-2026-12143 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-12143 advisory
- https://cwe.mitre.org/data/definitions/93.html advisory
- https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435 advisory
- https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229 advisory
- https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045 advisory
- https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx advisory
- https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data advisory
- https://www.npmjs.com/package/form-data advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
- https://go.dev/cl/761581 advisory
…and 70 more