CVE-2026-72816Medium· 6.5▾ Sunlitgo-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.Remot…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
6.5 → —
medium → high
— → 6.5
high → medium
6.5 → —
medium → high
— → 6.5
high → medium
6.5 → —
medium → high
— → 6.5
high → medium
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/go-chi/chi/middleware <= 1.5.5github.com/go-chi/chi/v2/middleware <= 2.1.1github.com/go-chi/chi/v3/middleware <= 3.3.5github.com/go-chi/chi/v4/middleware <= 4.1.3github.com/go-chi/chi/v5/middleware < 5.3.0Patched in:
github.com/go-chi/chi/v5/middleware 5.3.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
GHSA-rjr7-jggh-pgcpHighchi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header
CVE-2026-72817Medium· 6.5go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted …
GO-2026-5777NoneChi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi
GHSA-9g5q-2w5x-hmxfHighchi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution
CVE-2025-71405Mediumchi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes
CVE-2026-72815Mediumchi Has an IP Spoofing Vulnerability in `middleware.RealIP`