https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T02:10:51.472697+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-225673 EUVD-2026-225673 2026-10-07T02:10:51.475297+00:00 EUVD-2026-225673 https://cve.radiocsirt.org/vuln/fkie_cve-2025-30221 fkie_cve-2025-30221 2026-10-07T02:10:51.475331+00:00

Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/ghsa-pfqj-w6r6-g86v GHSA-pfqj-w6r6-g86v — Pitchfork HTTP Request/Response Splitting vulnerability 2026-10-07T02:10:51.475363+00:00

Affected: RubyGems: pitchfork

### Impact HTTP Response Header Injection in Pitchfork Versions < 0.11.0 when used in conjunction with Rack 3

### Patches The issue was fixed in Pitchfork release 0.11.0

### Workarounds There are no known work arounds. Users must upgrade.