CVE-2025-30221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-30221
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30221.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-30221
Aliases
Published
2025-03-27T14:46:32Z
Modified
2026-08-12T03:51:49Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Pitchfork HTTP Request/Response Splitting vulnerability
Details

Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-113"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30221.json"
}
References

Affected packages

Git / github.com/shopify/pitchfork

Affected ranges

Type
GIT
Repo
https://github.com/shopify/pitchfork
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
17ed9b61bf9f58957065f7405b66102daf86bf55
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.11.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.10.0
v0.2.0
v0.3.0
v0.4.0
v0.4.1
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30221.json"