CVE-2025-30221 json
Pitchfork HTTP Request/Response Splitting vulnerability
published 2025-03-27 19 mo ago modified 2026-06-17 4 mo ago also GHSA-pfqj-w6r6-g86v , EUVD-2025-14808
- cvss
- 4.3
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| GitHub | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | pitchfork | <0.11.0 |
0.11.0 |
Affected products
- Shopify pitchfork
Classification
- Weakness
-
- CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers
References
-
github.com
/Shopify/pitchfork/commit/17ed9b61bf9f58957065f7405b66102daf86bf55
web
-
github.com
/Shopify/pitchfork/security/advisories/GHSA-pfqj-w6r6-g86v
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-30221
advisory
-
github.com
/Shopify/pitchfork
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/pitchfork/CVE-2025-30221.yml
web
Sources
- CVE List CVE-2025-30221
- GitHub Advisory GHSA-pfqj-w6r6-g86v
- NVD CVE-2025-30221
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.