{"id":"CVE-2025-71405","title":"chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs","summary":"chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary ho…","severity":"medium","cvss":5.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-601"],"vendor":"go-chi","product":"chi","affected":["chi < 5.2.2"],"patched":["github.com/go-chi/chi/v5 5.2.2"],"published":"2026-08-14","updated":"2026-10-08","sourceUpdated":"2026-10-08T16:16:53.587","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71405","references":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-before-open-redirect-via-redirectslashes","label":"disclosure@vulncheck.com"},{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/go-chi/chi/commit/1be7ad938cc9c5b39a9dea01a5c518848928ab65"},{"url":"https://github.com/go-chi/chi"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71405"},{"url":"https://github.com/advisories/GHSA-vrw8-fxc6-2r93"}],"tags":["nvd","cve.org","exploit-available","osv","go","ghsa"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-14T18:57:32.118107Z"},"cvssSource":"cna","epss":0.00388,"epssPercentile":0.32758,"aliases":["GHSA-vrw8-fxc6-2r93","GO-2025-3770"],"ecosystem":"go","ingestedAt":"2026-08-15T19:19:53.859Z","slug":"CVE-2025-71405","body":"## Overview\n\nchi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-71405)\n\nAffected packages:\n\n- `github.com/go-chi/chi/v5 < 5.2.2`\n\nPatched in:\n\n- `github.com/go-chi/chi/v5 5.2.2`\n\nSource: https://osv.dev/vulnerability/GHSA-vrw8-fxc6-2r93","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":28.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":218147,"id":"CVE-2025-71405","ts":1791478444278,"field":"exploit_available","old":"false","new":"true"},{"seq":218146,"id":"CVE-2025-71405","ts":1791478444278,"field":"cvss","old":null,"new":"5.1"}]}