CRLF injection in form-data - CVE-2026-12143

Vulnerability identifier: #VU138926

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-12143

CWE-ID: CWE-93

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.

form-data
Netezza Appliance
Application Modernization Accelerator
DataStage on Cloud Pak for Data
Maximo Application Suite - Visual Inspection Component
Bitbucket Data Center
Confluence Data Center
Jira Software Data Center
Bamboo Data Center
Jira Service Management Data Center
IBM Cloud Transformation Advisor
IBM App Connect Enterprise
IBM Security SOAR
Red Hat OpenShift Container Platform
JBoss Data Grid

Install updates from vendor's website.

form-data - addressed in versions 2.5.6, 3.0.5, 4.0.6
Netezza Appliance - update to 1.0.2.0
Application Modernization Accelerator - update to 5.0.0
DataStage on Cloud Pak for Data - addressed in versions 5.3.1 patch 9, 5.4.0.0 patch 4
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.22, 9.1.19, 9.2.1
Bitbucket Data Center - addressed in versions 9.4.23, 10.2.6, 10.4.2
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
Jira Software Data Center - addressed in versions 10.3.24, 11.3.9
Bamboo Data Center - addressed in versions 10.2.22, 12.1.10
Jira Service Management Data Center - addressed in versions 10.3.24, 11.3.10
IBM App Connect Enterprise - addressed in versions 12.0.12.28, 13.0.8.0
IBM Security SOAR - update to 51.0.10.2
Red Hat OpenShift Container Platform - addressed in versions 4.20.31, 4.21.26
IBM Cloud Transformation Advisor - update to 5.0.0
JBoss Data Grid - update to 8.6.2

• https://cwe.mitre.org/data/definitions/93.html
• https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435
• https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229
• https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045
• https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx
• https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data
• https://www.npmjs.com/package/form-data
• https://access.redhat.com/errata/RHSA-2026:33155
• https://access.redhat.com/errata/RHSA-2026:33160
• https://access.redhat.com/errata/RHSA-2026:33163
• https://access.redhat.com/errata/RHSA-2026:33173
• https://access.redhat.com/errata/RHSA-2026:33183
• https://access.redhat.com/errata/RHSA-2026:34342
• https://access.redhat.com/errata/RHSA-2026:36319
• https://access.redhat.com/errata/RHSA-2026:36625
• https://access.redhat.com/errata/RHSA-2026:36754
• https://access.redhat.com/errata/RHSA-2026:40262
• https://access.redhat.com/errata/RHSA-2026:41031
• https://access.redhat.com/errata/RHSA-2026:41066
• https://access.redhat.com/security/cve/CVE-2026-12143
• https://bugzilla.redhat.com/show_bug.cgi?id=2488480
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json

• CRLF injection in form-data
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in Confluence Data Center
• IBM Security SOAR update for form-data
• IBM Maximo Application Suite - Visual Inspection Component update for form-data
• IBM Application Modernization Accelerator update for form-data
• IBM Transformation Advisor update for form-data
• IBM Netezza Appliance update for form-data
• Multiple vulnerabilities in JBoss Data Grid 8.6
• Multiple vulnerabilities in Bamboo Data Center
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data