86 matches found
CLEANSTART-2026-VB04097 Open Redirect vulnerability in the go-chi/chi >=5
Security vulnerability affects the step-cli package. An Open Redirect vulnerability in the go-chi/chi =5...
CVE-2026-72815-poc
CVE-2026-72815: go-chi/chi middleware.RealIP IP Spoofing PoC 日本語版 Overview This repository contains a local Proof of Concept PoC for CVE-2026-72815 GHSA-3fxj-6jh8-hvhx, an IP spoofing vulnerability in go-chi/chi's middleware.RealIP. The vulnerable middleware blindly trusts the first leftmost valu...
CLEANSTART-2026-YN83102 Open Redirect vulnerability in the go-chi/chi >=5
CVE-2025-69725 affects multiple packages. An Open Redirect vulnerability in the go-chi/chi =5. See references for individual vulnerability details...
UBUNTU-CVE-2026-118681
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path...
CVE-2026-118681
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path...
Authentication Bypass Using an Alternate Path or Channel
Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the SupressNotFound middleware in middleware/supressnotfound.go. An unauthenticated attacker can send a request to a mounted path whose suffix also matches a public root route...
CVE-2026-118681
Versions of go-chi chi prior to 5.5.0 are vulnerable to an authentication bypass in the middleware.SupressNotFound component. The root cause is that the middleware calls Match with a live routing context, which incorrectly preserves a mounted router's parameter and child suffix during dispatch ag...
CVE-2026-118681
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path...
CVE-2026-118681 go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path...
CVE-2026-118681 go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path...
CVE-2026-118681: go-chi chi: go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the…
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path...
Go Chi Chi authorization issue vulnerability
Versions prior to go-chi chi 5.5.0 contain an authorization issue vulnerability. This vulnerability stems from authentication bypass in middleware.SupressNotFound; it involves calling Match using a real-time routing context while retaining parameters and sub-tags associated with the mounted route...
Use of Less Trusted Source
Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...
Use of Less Trusted Source
Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...
Use of Less Trusted Source
Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...
Use of Less Trusted Source
Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...
Use of Less Trusted Source
Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...
Go Chi Chi Trust Management Vulnerability
Versions prior to go-chi chi 5.4.0 contain a trust management vulnerability. This issue arises because the ClientIPFromXFF middleware skips X-Forwarded-For entries within a configured trusted CIDR range; however, it fails to verify whether the direct TCP peer identified in http.Request.RemoteAddr...
