Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the realIP function. An attacker can bypass IP-based access controls, rate limiting, and audit logging by sending crafted headers such as X-Forwarded-For, X-Real-IP, or True-Client-IP without validation...

PT-2026-55845

Summary realip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass rate limits or access controls Details the vuln is in middleware/realip.go , the realIP function pulls IPs straight from client headers and replaces...