CVE-2025-30221

—

CVSS 3.0

4.3 medium

EPSS

<1%p20

Published

Mar 27, 2025 (Mar 27, 2025)

Modified

Jun 17, 2026

Description

Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.

Weakness: CWE-113
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.