CVE-2025-30221

RubyGems/pitchfork CVE-2025-30221: medium 4.3, EPSS 0.29%

Pitchfork HTTP Request/Response Splitting vulnerability

Action: Upgrade pitchfork to 0.11.0 or later.

bundle update pitchfork

Affected

Fixed versions

Sources

• osv: GHSA-pfqj-w6r6-g86v
• https://github.com/Shopify/pitchfork/security/advisories/GHSA-pfqj-w6r6-g86v
• https://nvd.nist.gov/vuln/detail/CVE-2025-30221
• https://github.com/Shopify/pitchfork/commit/17ed9b61bf9f58957065f7405b66102daf86bf55
• https://github.com/Shopify/pitchfork
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pitchfork/CVE-2025-30221.yml

CVE-2025-30221 · published 2025-03-27T18:01:18Z · modified 2025-03-28T16:31:51.247759Z · JSON