CVE-2025-30221 | THREATINT

Description

Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.

Reserved 2025-03-18 | Published 2025-03-27 | Updated 2025-03-27 | Assigner GitHub_M

MEDIUM: 4.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Problem types

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Product status

< 0.11.0

affected

References

github.com/...chfork/security/advisories/GHSA-pfqj-w6r6-g86v

github.com/...ommit/17ed9b61bf9f58957065f7405b66102daf86bf55

cve.org (CVE-2025-30221)

nvd.nist.gov (CVE-2025-30221)

Download JSON