medium4.3
CVE-2025-30221
Pitchfork HTTP Request/Response Splitting vulnerability
Impact
### Impact HTTP Response Header Injection in Pitchfork Versions < 0.11.0 when used in conjunction with Rack 3 ### Patches The issue was fixed in Pitchfork release 0.11.0 ### Workarounds There are no known work arounds. Users must upgrade.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | pitchfork | < 0.11.0 | 0.11.0 |
Affected products
| Product | Affected versions |
|---|---|
| Pitchfork Is A Preforking HTTP Server For Rack Applications. | before 0.11.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Shopify/pitchfork/commit/17ed9b61bf9f58957065f7405b66102daf86bf55
- https://github.com/Shopify/pitchfork/security/advisories/GHSA-pfqj-w6r6-g86v
- https://github.com/advisories/GHSA-pfqj-w6r6-g86v
- https://nvd.nist.gov/vuln/detail/CVE-2025-30221
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pitchfork/CVE-2025-30221.yml