CVE-2026-72816 go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

EUVD-2026-58631

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

CVE-2026-72817

The CVE affects go-chi/chi up to version 0.9.0 before 5.3.0, where the RealIP middleware resolves the source IP (Request.RemoteAddr) from the first IP in X-Forwarded-For without validating trusted proxies. An attacker can insert a forged value as the first IP, enabling IP spoofing that may bypass...

CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2026-72815

The CVE-2026-72815 affects go-chi chi v5.2.1 up to, but not including, v5.3.0. The RealIP middleware blindly trusts the leftmost value of X-Forwarded-For, enabling an attacker to bypass IP-based ACLs and rate limits and forge log entries by spoofing the IP address. The issue is fixed in v5.3.0. R...

EUVD-2026-58630

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2026-72815 go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2025-71405 go-chi chi before v5.2.2 Open Redirect via RedirectSlashes

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2025-71405 go-chi chi before v5.2.2 Open Redirect via RedirectSlashes

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2026-72816: Authentication Bypass by Spoofing

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

CVE-2026-72817: Insufficient Verification of Data Authenticity

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

CVE-2026-72815: Authentication Bypass by Spoofing

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

Linux Distros Unpatched Vulnerability : CVE-2026-72816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled header...

Linux Distros Unpatched Vulnerability : CVE-2026-72817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr...

Linux Distros Unpatched Vulnerability : CVE-2026-72815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the...

github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

github.com/go-chi/chi/middleware: go-chi/chi: IP spoofing via X-Forwarded-For header manipulation

A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For...

github.com/go-chi/chi: go-chi/chi: IP Spoofing via RealIP Middleware allows bypassing access controls

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...

Security Bulletin: Vulnerability in go-chi/chi bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the go-chi/chi library, which is affected by a denial of service vulnerability. CVE-2025-69725. Vulnerability Details CVEID:CVE-2025-69725 DESCRIPTION: An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashe...