CVE-2025-30221mediumCWE-113

CVE-2025-30221: medium-severity vulnerability in Shopify pitchfork

Pitchfork HTTP Request/Response Splitting vulnerability

Published

Follow this CVE+ Monitor pitchfork+ Monitor pitchfork

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.3%
Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
Shopify · pitchfork