GO-2026-5774None▾ SunlitChi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi
github.com/go-chi/chi/v5 >= 5.2.1, < 5.3.0Upgrade to a patched release:
github.com/go-chi/chi/v5 5.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-72815Medium· 6.9go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header
GO-2026-5777NoneChi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi
GO-2026-5775NoneChi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi
GHSA-3fxj-6jh8-hvhxMediumchi Has an IP Spoofing Vulnerability in `middleware.RealIP`
CVE-2026-114437Medium· 4.8chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
CVE-2025-69725Medium· 4.7chi has an open redirect vulnerability in the RedirectSlashes middleware