go-chi chi CVE-2026-72815

Exploitation requires two simultaneous conditions: first, the application must explicitly register middleware.RealIP in its chi router chain (r.Use(middleware.RealIP)); second, the application must implement access controls - IP-based ACLs, rate limiting, or audit logging - that rely on r.RemoteAddr or r.Request.RemoteAddr as overwritten by the middleware. Applications that do not use middleware.RealIP, or that use it but perform no IP-based gating, are not exploitable. No authentication is required and no non-default configuration is needed on the attacker side - the attack requires only the ability to send an HTTP request with a custom header. Exploitation is further limited to chi versions 5.2.1 through 5.2.x; both older chi v4 deployments and updated 5.3.0 deployments are unaffected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a straightforward, unauthenticated, low-complexity network attack with no prerequisites beyond sending an HTTP request - the lowest possible exploitation barrier. The scored impact is limited (VC:L/VI:L/VA:N), correctly capturing that the attack does not yield remote code execution or data exfiltration directly but enables ACL bypass and rate-limit evasion, which are themselves enablers for follow-on attacks. No EPSS data was supplied; however, given the public POC in the GHSA advisory and the trivial nature of the exploit (a single HTTP header), opportunistic exploitation of exposed endpoints is realistic wherever the middleware is deployed with IP-based controls. The vulnerability is NOT in CISA KEV, suggesting no confirmed widespread exploitation at this time. Real-world severity is context-dependent: applications that rely on chi's RealIP middleware for access control face meaningful risk, while those that do not use IP-based gating are functionally unaffected despite the vulnerability existing in the dependency.

An attacker targeting an IP-restricted chi endpoint sends a GET /admin/secret HTTP request with the header 'X-Forwarded-For: 1.2.3.4' (an allowlisted administrator IP) from their own arbitrary IP. The RealIP middleware overwrites r.RemoteAddr with '1.2.3.4', causing the application's IP-ACL check to succeed and granting access to the restricted resource. A working proof-of-concept demonstrating this bypass is published in the GHSA advisory.