CVE-2026-72816

The CVE-2026-72816 affects go-chi/chi up to version 5.2.1, specifically the RealIP middleware (realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, X-Forwarded-For) and overwrites r.RemoteAddr without validating the origin of the request from a trusted pro...

CVE-2026-72815 go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2026-72815

The CVE-2026-72815 affects go-chi chi v5.2.1 up to, but not including, v5.3.0. The RealIP middleware blindly trusts the leftmost value of X-Forwarded-For, enabling an attacker to bypass IP-based ACLs and rate limits and forge log entries by spoofing the IP address. The issue is fixed in v5.3.0. R...

CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

EUVD-2026-58630

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2026-72815 go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2026-72815 go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: nodetaint, aws-ebs-csi-driver, aws-efs-csi-driver, prometheus-adapter, kubernetes-dns-node-cache, aws-efs-csi-driver-fips, spark-operator, ip-masq-agent...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: cri-tools, kubernetes-csi-driver-hostpath, kubernetes-dns-node-cache, ip-masq-agent, nodetaint, argocd-image-updater, spark-operator, k8s-device-plugin, kubeflow-pipelines, aws-efs-csi-driver, local-static-provisioner...

GO-2024-3286 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, ip-masq-agent, nodetaint, argocd-image-updater, k8s-device-plugin, kubeflow-pipelines, aws-efs-csi-driver, local-static-provisioner...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, ip-masq-agent, nodetaint, prometheus-adapter, spark-operator, aws-efs-csi-driver...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kind, kubernetes-dashboard-auth, k3s, libnvidia-container, wal-g, swagger, eksctl, nri-memcached, nri-haproxy, thanos-operator, kapp-controller, rancher-system-agent, dive, falcoctl, containerd, dex, kuberlr, timescaledb-tune, ko, fzf, zot,...

Linux Distros Unpatched Vulnerability : CVE-2026-72815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the...

Linux Distros Unpatched Vulnerability : CVE-2026-72817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr...

CVE-2026-72815: Authentication Bypass by Spoofing

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

PT-2026-76555

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.3 Description Authenticated users can perform server-side requests to internal services and cloud metadata. This occurs because automation steps for outgoing webhooks, Zapier, n8n, Slack, and Discord use...

Linux Distros Unpatched Vulnerability : CVE-2026-72816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled header...

CVE-2026-72817: Insufficient Verification of Data Authenticity

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

CVE-2026-72816: Authentication Bypass by Spoofing

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...