What is CVE-2025-30221?

CVE-2025-30221 is a medium-severity vulnerability in Shopify Pitchfork, classified under HTTP Response Splitting. CVSS score: 4.3/10. Published 2025-03-27.

How severe is CVE-2025-30221?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Shopify Pitchfork

CVE-2025-30221

Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.

EPSS: 0.003 (18.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Affected products

Shopify Pitchfork — versions < 0.11.0

Weakness classification (CWE)

CWE-113 — HTTP Response Splitting

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-30221?: CVE-2025-30221 is a medium-severity vulnerability in Shopify Pitchfork, classified under HTTP Response Splitting. CVSS score: 4.3/10. Published 2025-03-27.
How severe is CVE-2025-30221?: Medium severity. CVSS v3 base score is 4.3 out of 10.