CVE-2026-72815
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.
Risk Assessment
The risk includes bypassing network security controls, potentially leading to unauthorized access and log manipulation, hindering attack detection.
Recommendation
Update go-chi/chi to version 5.3.0 or later and configure trusted proxies in the RealIP middleware.
Other vulnerabilities in go-chi/chi
See all- CVE-2026-72817Medium
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.
- CVE-2026-72816Medium
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.
- CVE-2025-69725Medium
An Open Redirect vulnerability in the RedirectSlashes function of go-chi/chi version 5.2.2 and later allows remote attackers to redirect victims to malicious websites using the legitimate website domain.
Original NVD description (English source)
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS