GHSA-xcvf-46f4-xwxfMedium▾ SunlitDuplicate Advisory: chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-vrw8-fxc6-2r93. This link is maintained to preserve external references.
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.
github.com/go-chi/chi <= 5.2.1Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-71405Mediumchi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs
CVE-2024-0953Medium· 6.1When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code
CVE-2026-72816Medium· 6.5go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go)
CVE-2026-72817Medium· 6.5go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted …
CVE-2026-72815Medium· 6.5go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header
CVE-2025-69725Medium· 4.7chi has an open redirect vulnerability in the RedirectSlashes middleware