What’s Vulnerable › Vulnerabilities

CVE-2025-30221: Pitchfork HTTP Request/Response Splitting vulnerability

• Severity: medium (CVSS 4.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-27 · updated 2026-06-17
• Weakness: CWE-113

Description

Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.

Affected products

• Shopify pitchfork: before 0.11.0

References

• https://github.com/Shopify/pitchfork/commit/17ed9b61bf9f58957065f7405b66102daf86bf55
• https://github.com/Shopify/pitchfork/security/advisories/GHSA-pfqj-w6r6-g86v

Get alerted when CVE-2025-30221 or the next vulnerability affects your stack