github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

github.com/go-chi/chi/middleware: go-chi/chi: IP spoofing via X-Forwarded-For header manipulation

A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For...

github.com/go-chi/chi: go-chi/chi: IP Spoofing via RealIP Middleware allows bypassing access controls

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...

github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

github.com/go-chi/chi/middleware: go-chi/chi: IP spoofing via X-Forwarded-For header manipulation

A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For...

github.com/go-chi/chi: go-chi/chi: IP Spoofing via RealIP Middleware allows bypassing access controls

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...

github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

GO-2026-5777 Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi...

GO-2026-5775 Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi...

GO-2026-5774 Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi...

ROOT-APP-GOBINARY-CVE-2025-69725 CVE-2025-69725 in rootio-github.com/go-chi/chi/v5 - Patched by Root

Root has patched CVE-2025-69725 in the rootio-github.com/go-chi/chi/v5 package for Root:Go. Multiple fixed versions available...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the realIP function. An attacker can bypass IP-based access controls, rate limiting, and audit logging by sending crafted headers such as X-Forwarded-For, X-Real-IP, or True-Client-IP without validation...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the realIP function. An attacker can bypass IP-based access controls, rate limiting, and audit logging by sending crafted headers such as X-Forwarded-For, X-Real-IP, or True-Client-IP without validation...

GHSA-RJR7-JGGH-PGCP chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

Summary realip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass rate limits or access controls Details the vuln is in middleware/realip.go , the realIP function pulls IPs straight from client headers and replaces...

PT-2026-55845

Summary realip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass rate limits or access controls Details the vuln is in middleware/realip.go , the realIP function pulls IPs straight from client headers and replaces...

PT-2026-71987

Name of the Vulnerable Software and Affected Versions go-chi/chi versions 0.9.0 through 5.2.9 Description The RealIP middleware resolves the request source IP Request.RemoteAddr by using the first IP address found in the X-Forwarded-For header without validating trusted proxies. This allows a...

PT-2026-71986

Name of the Vulnerable Software and Affected Versions go-chi/chi versions prior to 5.3.0 Description The RealIP middleware middleware/realip.go allows IP spoofing because the realIP function reads client-controlled headers and overwrites r.RemoteAddr without verifying if the request came from a...

SUSE CVE-2025-69725

An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain...

Duplicate Advisory: chi has an open redirect vulnerability in the RedirectSlashes middleware

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mqqf-5wvp-8fh8. This link is maintained to preserve external references. Original Description An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashes function allows remote attackers to redirect...

GHSA-4H76-926Q-WXXW Duplicate Advisory: chi has an open redirect vulnerability in the RedirectSlashes middleware

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mqqf-5wvp-8fh8. This link is maintained to preserve external references. Original Description An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashes function allows remote attackers to redirect...