{"id":"CVE-2026-72815","title":"go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header","summary":"go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access…","severity":"medium","cwe":["CWE-290","CWE-940"],"vendor":"go-chi","product":"github.com/go-chi/chi/v5/middleware","affected":["github.com/go-chi/chi/v5/middleware >= 5.2.1, < 5.3.0"],"patched":["github.com/go-chi/chi/v5/middleware 5.3.0"],"published":"2026-08-14","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:06:30.133","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72815","references":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-ip-spoofing-via-x-forwarded-for-header","label":"disclosure@vulncheck.com"},{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/go-chi/chi"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72815.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-72815"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515988"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72815"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72815"},{"url":"https://access.redhat.com/errata/RHSA-2026:54420"},{"url":"https://access.redhat.com/errata/RHSA-2026:50287"},{"url":"https://access.redhat.com/errata/RHSA-2026:49718"},{"url":"https://access.redhat.com/errata/RHSA-2026:49732"}],"tags":["nvd","exploit-available","osv","go","csaf","vex","red-hat"],"epss":0.00495,"epssPercentile":0.3988,"exploits":{"github":1,"githubRepos":["https://github.com/Saku0512/CVE-2026-72815-poc"],"checkedAt":"2026-09-26T09:05:58.375Z"},"exploitAvailable":true,"aliases":["GHSA-3fxj-6jh8-hvhx","GO-2026-5774"],"ecosystem":"go","ingestedAt":"2026-08-15T19:19:53.519Z","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvssSource":"vendor","slug":"CVE-2026-72815","body":"## Overview\n\ngo-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-72815)\n\nAffected packages:\n\n- `github.com/go-chi/chi/v5/middleware >= 5.2.1, < 5.3.0`\n\nPatched in:\n\n- `github.com/go-chi/chi/v5/middleware 5.3.0`\n\nSource: https://osv.dev/vulnerability/GHSA-3fxj-6jh8-hvhx\n\n## Vendor advisories\n\n- **RHSA-2026:54420** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54420)\n- **RHSA-2026:50287** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50287)\n- **RHSA-2026:49718** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49718)\n- **RHSA-2026:49732** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49732)\n- **Red Hat VEX** · Moderate · affected: Cryostat 4, External Secrets Operator for Red Hat OpenShift, Gatekeeper 3, Migration Toolkit for Applications 8, OpenShift Pipelines, Red Hat Advanced Cluster Management for Kubernetes 2, … · no fix planned: Red Hat Trusted Artifact Signer, Zero Trust Workload Identity Manager - Tech Preview, Cryostat 4, External Secrets Operator for Red Hat OpenShift, … · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72815.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":211317,"id":"CVE-2026-72815","ts":1790408683868,"field":"cvss","old":null,"new":"6.5"},{"seq":201891,"id":"CVE-2026-72815","ts":1789399974121,"field":"exploit_available","old":"false","new":"true"},{"seq":200621,"id":"CVE-2026-72815","ts":1789397537296,"field":"exploit_available","old":"true","new":"false"},{"seq":199335,"id":"CVE-2026-72815","ts":1789395455771,"field":"exploit_available","old":"false","new":"true"},{"seq":198580,"id":"CVE-2026-72815","ts":1789392135716,"field":"exploit_available","old":"true","new":"false"},{"seq":198535,"id":"CVE-2026-72815","ts":1789392062921,"field":"exploit_available","old":"false","new":"true"},{"seq":196326,"id":"CVE-2026-72815","ts":1789383702605,"field":"exploit_available","old":"true","new":"false"},{"seq":195255,"id":"CVE-2026-72815","ts":1789380539614,"field":"exploit_available","old":"false","new":"true"},{"seq":194042,"id":"CVE-2026-72815","ts":1789378648907,"field":"exploit_available","old":"true","new":"false"},{"seq":192829,"id":"CVE-2026-72815","ts":1789376469370,"field":"exploit_available","old":"false","new":"true"},{"seq":191616,"id":"CVE-2026-72815","ts":1789373555666,"field":"exploit_available","old":"true","new":"false"},{"seq":190401,"id":"CVE-2026-72815","ts":1789369416966,"field":"exploit_available","old":"false","new":"true"},{"seq":189188,"id":"CVE-2026-72815","ts":1789368347316,"field":"exploit_available","old":"true","new":"false"},{"seq":187971,"id":"CVE-2026-72815","ts":1789365200368,"field":"exploit_available","old":"false","new":"true"},{"seq":186758,"id":"CVE-2026-72815","ts":1789363411861,"field":"exploit_available","old":"true","new":"false"},{"seq":185544,"id":"CVE-2026-72815","ts":1789361182835,"field":"exploit_available","old":"false","new":"true"},{"seq":184331,"id":"CVE-2026-72815","ts":1789358274964,"field":"exploit_available","old":"true","new":"false"},{"seq":182582,"id":"CVE-2026-72815","ts":1789354275883,"field":"exploit_available","old":"false","new":"true"},{"seq":181375,"id":"CVE-2026-72815","ts":1789353247977,"field":"exploit_available","old":"true","new":"false"},{"seq":180168,"id":"CVE-2026-72815","ts":1789350228403,"field":"exploit_available","old":"false","new":"true"},{"seq":178961,"id":"CVE-2026-72815","ts":1789348224269,"field":"exploit_available","old":"true","new":"false"},{"seq":177754,"id":"CVE-2026-72815","ts":1789346332524,"field":"exploit_available","old":"false","new":"true"},{"seq":176547,"id":"CVE-2026-72815","ts":1789343130515,"field":"exploit_available","old":"true","new":"false"},{"seq":174664,"id":"CVE-2026-72815","ts":1789334840619,"field":"exploit_available","old":"false","new":"true"},{"seq":173459,"id":"CVE-2026-72815","ts":1789333609202,"field":"exploit_available","old":"true","new":"false"},{"seq":172273,"id":"CVE-2026-72815","ts":1789331056346,"field":"exploit_available","old":"false","new":"true"},{"seq":171087,"id":"CVE-2026-72815","ts":1789328714344,"field":"exploit_available","old":"true","new":"false"},{"seq":169882,"id":"CVE-2026-72815","ts":1789327128061,"field":"exploit_available","old":"false","new":"true"},{"seq":168677,"id":"CVE-2026-72815","ts":1789323769721,"field":"exploit_available","old":"true","new":"false"},{"seq":167472,"id":"CVE-2026-72815","ts":1789319652418,"field":"exploit_available","old":"false","new":"true"},{"seq":166267,"id":"CVE-2026-72815","ts":1789318696447,"field":"exploit_available","old":"true","new":"false"},{"seq":165062,"id":"CVE-2026-72815","ts":1789315759886,"field":"exploit_available","old":"false","new":"true"},{"seq":163857,"id":"CVE-2026-72815","ts":1789313569446,"field":"exploit_available","old":"true","new":"false"},{"seq":162652,"id":"CVE-2026-72815","ts":1789311871918,"field":"exploit_available","old":"false","new":"true"},{"seq":161447,"id":"CVE-2026-72815","ts":1789308661519,"field":"exploit_available","old":"true","new":"false"},{"seq":159560,"id":"CVE-2026-72815","ts":1789300444678,"field":"exploit_available","old":"false","new":"true"},{"seq":158761,"id":"CVE-2026-72815","ts":1789299560802,"field":"exploit_available","old":"true","new":"false"},{"seq":157724,"id":"CVE-2026-72815","ts":1789296609412,"field":"exploit_available","old":"false","new":"true"},{"seq":156549,"id":"CVE-2026-72815","ts":1789294700232,"field":"exploit_available","old":"true","new":"false"},{"seq":155344,"id":"CVE-2026-72815","ts":1789292866985,"field":"exploit_available","old":"false","new":"true"},{"seq":154139,"id":"CVE-2026-72815","ts":1789289723515,"field":"exploit_available","old":"true","new":"false"},{"seq":152789,"id":"CVE-2026-72815","ts":1789281621480,"field":"exploit_available","old":"false","new":"true"},{"seq":152429,"id":"CVE-2026-72815","ts":1789281205158,"field":"exploit_available","old":"true","new":"false"},{"seq":151390,"id":"CVE-2026-72815","ts":1789277587460,"field":"exploit_available","old":"false","new":"true"},{"seq":150351,"id":"CVE-2026-72815","ts":1789276191109,"field":"exploit_available","old":"true","new":"false"},{"seq":149318,"id":"CVE-2026-72815","ts":1789273794243,"field":"exploit_available","old":"false","new":"true"},{"seq":148285,"id":"CVE-2026-72815","ts":1789271272197,"field":"exploit_available","old":"true","new":"false"},{"seq":146317,"id":"CVE-2026-72815","ts":1789269342362,"field":"exploit_available","old":"false","new":"true"},{"seq":145122,"id":"CVE-2026-72815","ts":1789266286084,"field":"exploit_available","old":"true","new":"false"},{"seq":144026,"id":"CVE-2026-72815","ts":1789262576034,"field":"exploit_available","old":"false","new":"true"}]}