CVE-2025-30221

4.3 mediumEPSS 0.3%

Medium (4.3). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in pitchfork 0.11.0.

Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.

Severity

CVSS 3.0

4.3 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-113
Published: 2025-03-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-pfqj-w6r6-g86v	RubyGems	pitchfork	<0.11.0	0.11.0

References

https://github.com/Shopify/pitchfork/commit/17ed9b61bf9f58957065f7405b66102daf86bf55
https://github.com/Shopify/pitchfork/security/advisories/GHSA-pfqj-w6r6-g86v

Check your stack JSON