CVE-2026-72816 go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

CVE-2026-72816 go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

CVE-2026-72816

The CVE-2026-72816 affects go-chi/chi up to version 5.2.1, specifically the RealIP middleware (realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, X-Forwarded-For) and overwrites r.RemoteAddr without validating the origin of the request from a trusted pro...

GO-2025-3604 vulnerabilities

Vulnerabilities for packages: mattermost-fips...

GO-2026-5748 vulnerabilities

Vulnerabilities for packages: mods, k8sgpt...

GO-2025-3987 vulnerabilities

Vulnerabilities for packages: hydra-fips, hydra, weaviate...

GO-2025-3742 vulnerabilities

Vulnerabilities for packages: grafana-fips...

GO-2026-4412 vulnerabilities

Vulnerabilities for packages: cg, wolfictl...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: qdrant, wadm, atuin, rye, samply, sdp-k8s-injector, tealdeer, wasmcloud, ntpd-rs, uv, oranda, ztunnel, wash, deno, zed, kdash, wasm-pack, lychee, xh, cargo-audit, zizmor, shadowsocks-rust, zola, rustup, wasmtime, nushell, sqlx, parseable, sccache,...

GO-2026-5224 vulnerabilities

Vulnerabilities for packages: rancher-agent, cloudbeat, authentik-fips, azure-service-operator, azure-service-operator-fips, vault, rancher, vault-fips, authentik, cloudbeat-fips...

GO-2022-0646 vulnerabilities

Vulnerabilities for packages: rancher-agent, kube-arangodb, gatekeeper-fips, kube-arangodb-fips, zot, elastic-agent, loki, prometheus, consul, external-secrets-operator-fips, cloud-sql-proxy, tigera-operator, opentelemetry-collector-k8s, kots, vault-fips, opentelemetry-collector, dapr,...

GO-2026-5327 vulnerabilities

Vulnerabilities for packages: milvus, cloudbeat, beats-fips, opentelemetry-collector-contrib, terraform-provider-pagerduty, consul-k8s-fips, kubeflow-pipelines-driver-fips, cortex, cilium-fips, thanos, virt-operator, trufflehog-fips, ory-kratos-fips, teleport-operator-fips, authentik-fips, harbor...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy-fips, minio-object-browser-fips, beats-fips, plutono, mcp-grafana-fips, trillian-fips, agentbeat-fips, mc-fips, splunk-otel-collector-fips, cloudzero-agent-fips, elastic-agent, loki, mcp-grafana, certificate-transparency, grafana-pyroscope, minio,...

GO-2024-2599 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy-fips, chainctl, rabbitmq-cluster-operator, goreleaser, vault-k8s-fips, govulncheck, vite, jsonnet-bundler, logstash-exporter-fips, docker-credential-ecr-login, cue, litefs, nri-apache, cortex, aws-load-balancer-controller, nats,...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, crossplane-provider-family-aws, tkn, goreleaser, aactl, crossplane-provider-aws-sns, zarf, crossplane-provider-aws-elasticache, cosign, gomplate, policy-controller, crossplane-provider-aws-iam, tekton-chains, zot,...

GO-2026-5019 vulnerabilities

Vulnerabilities for packages: snyk-cli, chainctl, cloudbeat, syft-fips, commercial-expanso-edge, crossplane-provider-azure-security, kube-arangodb-fips, neuvector-sigstore-interface, etcd-fips, terragrunt-fips, crossplane-provider-azure-web, hcloud, crossplane-provider-azure-securityinsights,...

GO-2025-3563 vulnerabilities

Vulnerabilities for packages: snyk-cli, chainctl, prometheus-mysqld-exporter-fips, goreleaser, docker-credential-ecr-login, hcloud, cortex, maru, rclone-fips, pulumi-kubernetes-operator, kapp-fips, grafana-rollout-operator-fips, rclone, yunikorn-web, rabbitmq-default-user-credential-updater,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: glow, crossplane-provider-aws-route53, crossplane-provider-family-aws, chainctl, snyk-cli, goreleaser, docker-compose, logstash-exporter-fips, docker-credential-ecr-login, hcloud, cortex, pulumi-kubernetes-operator, rclone, rabbitmq-default-user-credential-updater,...

GO-2026-5029 vulnerabilities

Vulnerabilities for packages: gptscript, karpenter, terraform-provider-acme, step, mattermost, kine, helm, crossplane-provider-aws-elasticache, kots, gitea, kubernetes-dashboard, caddy, prometheus, ingress-nginx-controller, opentelemetry-collector, zot, fq, traefik, glab, vale, hubble, step-issue...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: atuin, oranda, wasm-pack, nushell, kdash, uv, tealdeer, zed, sqlx, wash, qdrant, deno, samply, wasmcloud, linkerd2-proxy, buck2, rustls-ffi, pixi, shadowsocks-rust, zizmor, linkerd-extension-init, wadm, wasmtime, cargo-audit, parseable, xh, sdp-k8s-injector, rye,...