CRLF injection in form-data - CVE-2026-12143

Vulnerability identifier: #VU138926

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-12143

CWE-ID: CWE-93

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.

form-data
Netezza Appliance
Optim
Db2 Developer Extension
Application Modernization Accelerator
DataStage on Cloud Pak for Data
Maximo Application Suite - Visual Inspection Component
InfoSphere Optim Archive Viewer
Robotic Process Automation for Cloud Pak
QRadar Threat Intelligence
QRadar Deployment Intelligence App
Crowd Data Center
Confluence Data Center
Bitbucket Data Center
Jira Software Data Center
Bamboo Data Center
Jira Service Management Data Center
IBM Cloud Transformation Advisor
IBM DataPower Gateway
Red Hat OpenShift Container Platform
IBM App Connect Enterprise
IBM Security SOAR
JBoss Data Grid

Install updates from vendor's website.

form-data - addressed in versions 2.5.6, 3.0.5, 4.0.6
Netezza Appliance - update to 1.0.2.0
Optim - update to 2.0.0
Db2 Developer Extension - update to 1.2.0
Application Modernization Accelerator - update to 5.0.0
DataStage on Cloud Pak for Data - addressed in versions 5.3.1 patch 9, 5.4.0.0 patch 4
Crowd Data Center - update to 7.2.3
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.22, 9.1.19, 9.2.1
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
Bitbucket Data Center - addressed in versions 9.4.23, 10.2.6, 10.4.2
Jira Software Data Center - addressed in versions 10.3.24, 11.3.9
Bamboo Data Center - addressed in versions 10.2.22, 12.1.10
Jira Service Management Data Center - addressed in versions 10.3.24, 11.3.10
IBM DataPower Gateway - addressed in versions 10.5.0.23, 10.6.0.11, 11.0.0.3
InfoSphere Optim Archive Viewer - update to 11.7.0.15
IBM App Connect Enterprise - addressed in versions 12.0.12.28, 13.0.8.0
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.7, 30.0.4
IBM Security SOAR - update to 51.0.10.2
QRadar Threat Intelligence - update to 2.6.0
QRadar Deployment Intelligence App - update to 3.0.20
Red Hat OpenShift Container Platform - addressed in versions 4.20.31, 4.21.26
IBM Cloud Transformation Advisor - update to 5.0.0
JBoss Data Grid - update to 8.6.2

• https://cwe.mitre.org/data/definitions/93.html
• https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435
• https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229
• https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045
• https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx
• https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data
• https://www.npmjs.com/package/form-data
• https://access.redhat.com/errata/RHSA-2026:33155
• https://access.redhat.com/errata/RHSA-2026:33160
• https://access.redhat.com/errata/RHSA-2026:33163
• https://access.redhat.com/errata/RHSA-2026:33173
• https://access.redhat.com/errata/RHSA-2026:33183
• https://access.redhat.com/errata/RHSA-2026:34342
• https://access.redhat.com/errata/RHSA-2026:36319
• https://access.redhat.com/errata/RHSA-2026:36625
• https://access.redhat.com/errata/RHSA-2026:36754
• https://access.redhat.com/errata/RHSA-2026:40262
• https://access.redhat.com/errata/RHSA-2026:41031
• https://access.redhat.com/errata/RHSA-2026:41066
• https://access.redhat.com/security/cve/CVE-2026-12143
• https://bugzilla.redhat.com/show_bug.cgi?id=2488480
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json

• CRLF injection in form-data
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in Confluence Data Center
• IBM Security SOAR update for form-data
• IBM Maximo Application Suite - Visual Inspection Component update for form-data
• IBM Application Modernization Accelerator update for form-data
• IBM Transformation Advisor update for form-data
• IBM Netezza Appliance update for form-data
• Multiple vulnerabilities in JBoss Data Grid 8.6
• Multiple vulnerabilities in Bamboo Data Center
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in Crowd Data Center
• IBM Db2 Developer Extension update for form-data
• IBM InfoSphere Optim Archive Viewer update for form-data
• IBM Optim update for form-data
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• IBM DataPower Gateway update for form-data
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak