go-chi CVE-2025-71405

Three conditions must be met simultaneously: (1) the target chi application must have RedirectSlashes middleware explicitly registered in its router chain-it is not enabled by default in all chi deployments; (2) the attacker must be able to control the HTTP Host header value in requests reaching the chi server-this is categorically not possible from standard web browsers or email clients, which automatically set the Host header to the actual target server, meaning typical browser-based phishing delivery is blocked without an additional primitive; and (3) a user or automated process must follow the issued redirect to the attacker-specified domain. Exploitation is limited to non-browser HTTP request contexts such as SSRF chains, misconfigured proxies, curl/wget-style tooling, or server-to-server calls. The CVSS 4.0 UI:A confirms user interaction is required for any meaningful impact. There is no authentication requirement to trigger the redirect response itself.

The CVSS 4.0 score of 5.1 (Medium) reflects network accessibility with no required authentication but mandatory user interaction. The GHSA advisory-written by the chi maintainers-explicitly classifies this as lower-severity because the Host header cannot be manipulated from browsers or email clients, the two most common phishing delivery vectors. This is the most significant limiting factor: typical web-user-targeting phishing scenarios are not directly achievable without an additional mechanism to forge the Host header. Realistic exploitation requires either a server-side request forgery chain, a misconfigured reverse proxy, or a custom HTTP client in a server-to-server context. The NVD/CISA KEV does not list this CVE, and no EPSS score was provided in the source data. No conflicting signals are present-the low-to-medium CVSS rating is consistent with the advisory's own characterization and the technical constraint on the attack vector.

An attacker who controls the HTTP Host header-via a server-side request forgery vulnerability in another service, a misconfigured reverse proxy that forwards arbitrary Host values, or direct access with a custom HTTP client-sends a request to the chi application targeting a path with a trailing slash. The RedirectSlashes middleware constructs a redirect URL using the forged Host value and returns a 3xx response pointing to the attacker's phishing domain. Any user or automated process following that redirect lands on an attacker-controlled site designed to harvest credentials under the appearance of a trusted application URL. A functional PoC demonstrating this end-to-end via curl is included in the GHSA advisory.