CVE-2026-72817
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.
- CVSS 4.0
- 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-25)
- CWE
- CWE-345
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9g5q-2w5x-hmxf | Go | github.com/go-chi/chi/middleware | >=0.9.0 <=1.5.5 | no fix published |
| GHSA-9g5q-2w5x-hmxf | Go | github.com/go-chi/chi/v2/middleware | <=2.1.1 | no fix published |
| GHSA-9g5q-2w5x-hmxf | Go | github.com/go-chi/chi/v3/middleware | <=3.3.5 | no fix published |
| GHSA-9g5q-2w5x-hmxf | Go | github.com/go-chi/chi/v4/middleware | <=4.1.3 | no fix published |
| GHSA-9g5q-2w5x-hmxf | Go | github.com/go-chi/chi/v5/middleware | <5.3.0 | 5.3.0 |
| GO-2026-5775 | Go | github.com/go-chi/chi/v5 | <5.3.0 | 5.3.0 |