GitHub Advisoryadvisory · RubyGems

GHSA-pfqj-w6r6-g86v Pitchfork HTTP Request/Response Splitting vulnerability

MEDIUM Published 2025-03-27 Modified 2025-03-28 Official page ↗
Aliases
CVE-2025-30221
Ecosystem
RubyGems
Packages
pitchfork
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-113
Reviewed
2025-03-27

Affected packages

• RubyGems pitchfork: < 0.11.0 → fixed in 0.11.0

Description

Impact HTTP Response Header Injection in Pitchfork Versions < 0.11.0 when used in conjunction with Rack 3 Patches The issue was fixed in Pitchfork release 0.11.0 Workarounds There are no known work arounds. Users must upgrade.

Related

Alias · CVE (1)

  • CVE-2025-30221 Pitchfork is a preforking HTTP server for Rack applications. vulnerability

Weakness · CWE (1)

  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers weakness

References