CVE-2025-71405

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2025-71405

The CVE-2025-71405 entry concerns the chi library prior to v5.2.2. The vulnerability lies in the RedirectSlashes middleware, which uses the Host header to build redirect URLs. An attacker can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing and credential theft. ...

CVE-2025-71405 go-chi chi before v5.2.2 Open Redirect via RedirectSlashes

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2025-71405

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2025-71405 go-chi chi before v5.2.2 Open Redirect via RedirectSlashes

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

Open Redirect

Spring Security is vulnerable to Open Redirect. The vulnerability is due to CookieRequestCache and CookieServerRequestCache storing and using an unvalidated absolute URL from a browser cookie as the post-login redirect target, allowing an attacker to redirect users to a malicious destination...

GO-2024-2907 vulnerabilities

Vulnerabilities for packages: nuclei...

GO-2025-3604 vulnerabilities

Vulnerabilities for packages: mattermost-fips...

GO-2024-2576 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, pulumi-language-java, zarf, flux-source-controller-fips, grafana-alloy, crossplane, flux-kustomize-controller, k9s, snyk-cli, src-fingerprint, task, tekton-pipelines, nemo, flux-kustomize-controller-fips, gitsign, argo-workflows, kaniko-fips,...

GO-2026-5005 vulnerabilities

Vulnerabilities for packages: podman-fips, opentofu-fips, cilium-cli, argo-workflows, reports-server, frankenphp-8.2, argo-workflows-fips, keda-fips, backup-restore-operator, external-dns, frankenphp-8.4, flux, kuma, rancher-agent, knative-kafka-broker-fips, cert-manager, istio,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: cosign-fips, tekton-chains-fips, zarf, commercial-chainloop-backend, flux-source-controller-fips, crossplane, witness, kyverno-notation-aws, commercial-kyverno, kyverno-policy-reporter-plugins-kyverno-fips, spire-server-fips, teleport-operator-fips, gitsign, ko-fips,...

GO-2026-5593 vulnerabilities

Vulnerabilities for packages: sftpgo, traefik...

GO-2022-0574 vulnerabilities

Vulnerabilities for packages: opa...

GO-2022-0587 vulnerabilities

Vulnerabilities for packages: opa...

GO-2026-4962 vulnerabilities

Vulnerabilities for packages: mattermost...

GO-2025-3565 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GO-2025-3988 vulnerabilities

Vulnerabilities for packages: sftpgo, gitea...

GO-2024-2476 vulnerabilities

Vulnerabilities for packages: dex...

GO-2026-5029 vulnerabilities

Vulnerabilities for packages: istio, zot, kine, kots, fq, nerdctl, step-issuer, traefik, gitea, kubernetes-dashboard, prometheus-operator, vale, gptscript, ingress-nginx-controller, kubernetes, falco-no-driver, crossplane-provider-aws-elasticache, helm, crossplane-provider-azure-storage, k3s,...