CVE-2025-30221CWE-113

Pitchfork HTTP Request/Response Splitting vulnerability

Medium · published March 27, 2025

CVSS v3.0
4.3
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00291 · 20.6th percentile
Weakness
CWE-113 · Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Published
2025-03-27T14:46Z
EPSS history
Timeline
  • 27 MAR 14:46Z
    Pitchfork HTTP Request/Response Splitting vulnerability
    cvelistv5