252 matches found
SUSE CVE-2026-72816
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...
SUSE CVE-2026-72817
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...
go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For
...
go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware
...
Linux Distros Unpatched Vulnerability : CVE-2025-71405
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URL...
CVE-2026-72817
A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For...
CVE-2026-72815
A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...
CVE-2026-72816
A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...
GHSA-XCVF-46F4-XWXF Duplicate Advisory: chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vrw8-fxc6-2r93. This link is maintained to preserve external references. Original Description chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that use...
Duplicate Advisory: chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vrw8-fxc6-2r93. This link is maintained to preserve external references. Original Description chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that use...
AZL-96689 CVE-2026-72816 affecting package influxdb 2.7.5-21
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...
AZL-96635 CVE-2026-72816 affecting package gh for versions less than 2.97.0-1
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...
AZL-96692 CVE-2026-72817 affecting package influxdb for versions less than 2.7.5-21
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...
CVE-2026-72816
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...
CVE-2026-72815
go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...
CVE-2026-72817
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...
DEBIAN-CVE-2025-71405
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...
CVE-2025-71405
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...
UBUNTU-CVE-2026-72817
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...
UBUNTU-CVE-2026-72815
go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...