Back to Database
Status published
Medium
CVE-2025-30221
Pitchfork HTTP Request/Response Splitting vulnerability
Vulnerability Description
Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-30221
Credits & Attribution
No credits recorded in the NVD database.
References
More from Shopify
View All →CVE-2025-53623
Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class
High
8.1
CVE-2025-48069
ejson2env has insufficient input sanitization
Medium
6.6
CVE-2024-45036
Improper Access Control Vulnerability When Accessing a Maliciously Crafted Tophat Link
Medium
4.3
CVE-2022-29230
Potential cross-site scripting (XSS) vulnerability in Hydrogen
Medium
6.3
Affected Vendor
Shopify
View all reports →Affected Software
pitchfork
Vulnerable Versions:
< 0.11.0
Timeline
Official Publish:
March 27th, 2025
Last Modified:
March 27th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.