CVE-2025-30221

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-113

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-302222.1Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable expo CVE-2025-302239.6Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in CVE-2025-302245.1MyDumper is a MySQL Logical Backup Tool. The MySQL C client library (libmysqlclient) allows authenticated remote actors to read arbitrary fi CVE-2025-302255.3Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in versi CVE-2025-302327.8A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges.CVE-2025-302348.3SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a Deb CVE-2025-302353.5Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication atte CVE-2025-302368.6Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) CVE-2025-302378.7The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced CVE-2025-302388.6In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privil CVE-2025-302398.5In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may CVE-2025-302405.1The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted sy