CVE catalog

CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-F

[CVE catalog]

Severity
Medium · CVSS 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.24% · Oct 25, 2026

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-go-chi-chisid5.3.0-1fixed
Debiangolang-github-go-chi-chiforky5.3.0-1fixed
Debiangolang-github-go-chi-chitrixie5.2.0-1vulnerable
Debiangolang-github-go-chi-chibookworm5.0.7-1vulnerable
Opensusev2ray-coretumbleweed5.53.0-1.1fixed
Opensusetrivytumbleweed0.74.0-1.1fixed
Ubuntugolang-github-go-chi-chi22.041.5.1-2vulnerable
Ubuntugolang-github-go-chi-chi22.045.0.7-1vulnerable
Ubuntugolang-github-go-chi-chi24.045.0.7-1vulnerable
Ubuntugolang-github-go-chi-chi26.045.2.0-1vulnerable
Ubuntugolang-github-go-chi-chi26.045.2.3-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-go-chi-chisourcesid5.3.0-1not yet assignedNot reportedNot reported
Debiangolang-github-go-chi-chisourceforky5.3.0-1not yet assignedNot reportedNot reported
Debiangolang-github-go-chi-chisourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-go-chi-chisourcebookworm(unfixed)not yet assignedNot reportedNot reported
Opensusev2ray-corerpmtumbleweed5.53.0-1.1Not reportedOPENSUSE-SU-2026:11591-1Not reported
Opensusetrivyrpmtumbleweed0.74.0-1.1Not reportedOPENSUSE-SU-2026:11578-1Not reported

Notes

[trixie] golang-github-go-chi-chi: Minor issue [bookworm] golang-github-go-chi-chi: Minor issue; out of LTS support

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-go-chi-chi-dev]Affected

    Source package: [golang-github-go-chi-chi]

    Details (2)

    • 5.0.7-1 · all · bookworm

      Affected

      nvd · golang-github-go-chi-chi · debian · bookworm; nvd · golang-github-go-chi-chi · debian · 12

    • 5.0.7-1 · all · bookworm

      Affected

      nvd · golang-github-go-chi-chi · debian · bookworm; nvd · golang-github-go-chi-chi · debian · 12

[Debian 13 (Trixie)]

[openSUSE Tumbleweed]

  • [golang-github-v2fly-v2ray-core]Unknown

    Source package: [v2ray-core]

    Details (1)

    • 5.53.0-2.1 · noarch · tumbleweed

      Unknown · Fixed: 5.53.0-1.1

      Version impact unknown

      nvd · v2ray-core · opensuse · tumbleweed

  • [trivy]Fixed

    Source package: [trivy]

    Details (1)

    • 0.74.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 0.74.0-1.1

      nvd · trivy · opensuse · tumbleweed

  • [v2ray-core]Fixed

    Source package: [v2ray-core]

    Details (1)

    • 5.53.0-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 5.53.0-1.1

      nvd · v2ray-core · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]