CVE-2026-72815
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.
Risk Assessment
The risk includes bypassing network security controls, potentially leading to unauthorized access and log manipulation, hindering attack detection.
Recommendation
Update go-chi/chi to version 5.3.0 or later and configure trusted proxies in the RealIP middleware.
Original NVD description (English source)
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.