CVE-2025-30221: Pitchfork HTTP Header Injection Flaw

CVE-2025-30221 Overview

CVE-2025-30221 is an HTTP Response Header Injection vulnerability [CWE-113] affecting Pitchfork, a preforking HTTP server for Rack applications maintained by Shopify. Versions prior to 0.11.0 fail to filter illegal characters from response headers when used with Rack 3. Attackers can inject carriage return and line feed characters into response headers, enabling response splitting attacks against downstream clients. The maintainers fixed the issue in Pitchfork 0.11.0 by dropping response headers that contain invalid characters. No workarounds exist for unpatched deployments.

Critical Impact
Attackers can manipulate HTTP responses to inject arbitrary headers, potentially enabling cache poisoning, cross-site scripting, or session fixation against users of vulnerable Rack 3 applications served by Pitchfork.

Affected Products

Shopify Pitchfork HTTP server versions prior to 0.11.0
Rack 3 applications served by vulnerable Pitchfork versions
Ruby web applications relying on Pitchfork as their preforking HTTP server

Discovery Timeline

2025-03-27 - CVE-2025-30221 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30221

Vulnerability Analysis

Pitchfork is a preforking HTTP server derived from Unicorn and used to serve Ruby Rack applications. The vulnerability exists in how Pitchfork constructs outbound HTTP responses when paired with Rack 3. Response header values are written directly to the client socket without filtering control characters. When an application echoes untrusted input into a header, attackers can inject \r\n sequences to terminate the current header and inject additional headers or a new response body.

This class of flaw is HTTP Response Splitting, a subset of HTTP Response Header Injection. Successful exploitation depends on the application passing attacker-controlled data into a response header. The Rack 3 specification loosened certain header validation assumptions that earlier Rack versions enforced, exposing the gap in Pitchfork's header-serialization path.

Root Cause

The lib/pitchfork/http_response.rb module did not reject header values containing NUL bytes, line feeds, or other control characters in the ranges \\x00-\\x08 and \\x0A-\\x1F. The upstream fix adds an ILLEGAL_HEADER_VALUE regular expression and drops any response header matching it before serialization.

Attack Vector

Exploitation requires an attacker to influence a value that the Rack application places into a response header, then trigger a victim to load the resulting response. This typically involves a crafted URL parameter or request header reflected into a redirect target, cookie, or custom header. User interaction is required, and no authentication is needed to reach the vulnerable code path.

ruby

     STATUS_CODES = defined?(Rack::Utils::HTTP_STATUS_CODES) ?
                    Rack::Utils::HTTP_STATUS_CODES : {}
 
+    ILLEGAL_HEADER_VALUE = /[\\x00-\\x08\\x0A-\\x1F]/
+
     # internal API, code will always be common-enough-for-even-old-Rack
     def err_response(code, response_start_sent)
       "#{response_start_sent ? '' : 'HTTP/1.1 '}" \

Source: Shopify Pitchfork commit 17ed9b6 — the patch introduces the ILLEGAL_HEADER_VALUE regex used to filter out headers that contain control characters before they are written to the response stream.

Detection Methods for CVE-2025-30221

Indicators of Compromise

HTTP request logs containing %0d%0a, %0D%0A, or raw CR/LF characters in query parameters, path segments, or headers
Response logs showing unexpected duplicate Set-Cookie, Location, or Content-Type headers on requests handled by Pitchfork
Web application firewall (WAF) alerts flagging CRLF injection patterns against Rack endpoints backed by Pitchfork

Detection Strategies

Inventory Ruby application deployments and identify the pitchfork gem version in Gemfile.lock; flag any version below 0.11.0
Inspect application middleware and controllers for user input reflected into Location, Set-Cookie, or custom response headers without sanitization
Deploy runtime rules that decode URL-encoded input and match on CR (\\x0D) or LF (\\x0A) bytes reaching request handlers

Monitoring Recommendations

Forward reverse proxy, load balancer, and application access logs to a central analytics platform for pattern matching on CRLF sequences
Alert on responses containing anomalous header counts or duplicated critical headers for endpoints served by Pitchfork
Baseline expected response header sets per endpoint so injected headers surface as deviations

How to Mitigate CVE-2025-30221

Immediate Actions Required

Upgrade the pitchfork gem to version 0.11.0 or later in every affected deployment
Audit Rack applications for controllers or middleware that place unvalidated request data into response headers
Restart Pitchfork worker processes after upgrading so the patched code path is loaded

Patch Information

The fix is available in Pitchfork 0.11.0. The upstream commit 17ed9b61bf9f58957065f7405b66102daf86bf55 introduces the ILLEGAL_HEADER_VALUE regex and drops any response header containing invalid characters before writing to the socket. Additional context is available in the GitHub Security Advisory GHSA-pfqj-w6r6-g86v.

Workarounds

No vendor-provided workarounds exist; upgrading to 0.11.0 is the only supported remediation
As a defense-in-depth measure, sanitize any user-controlled input at the application layer before assigning it to response headers
Configure an upstream reverse proxy or WAF to reject requests containing raw or URL-encoded CRLF sequences in header values and query parameters

bash

# Update the pitchfork gem to the patched release
bundle update pitchfork --conservative

# Verify the installed version is 0.11.0 or later
bundle info pitchfork | grep -i version