go-chi chi CVE-2026-72817

Exploitation requires three specific conditions to be present simultaneously. First, the application must explicitly register middleware.RealIP() in its chi middleware chain - this middleware is not enabled by default and must be intentionally added by the developer. Second, the application must use Request.RemoteAddr (after the middleware rewrites it) to make security-relevant decisions such as IP allowlist enforcement, rate limiting by IP, or trust boundary determination. Third, the request must traverse at least one intermediary proxy or load balancer that passes or appends to the X-Forwarded-For header, providing cover for the attacker's prepended forged IP. Limiting factors: applications using RealIP solely for non-security audit logging have no access control bypass exposure; direct TCP connections without proxies reduce but do not eliminate spoofing if the attacker controls network-layer routing; and the vulnerability is present only in the specific middleware.RealIP() function, not in chi's core routing logic.

The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L) correctly reflects unauthenticated, low-complexity network exploitation with limited but real integrity and confidentiality impact. Real-world risk is conditional on deployment patterns: exploitation is only meaningful when the application both enables middleware.RealIP() and uses the resolved IP for security decisions such as allowlist enforcement or trusted-zone gating. Applications using it solely for non-security logging face log falsification risk but no access control bypass. A public PoC lowers the exploitation bar to commodity level - any attacker who can send HTTP requests with custom headers can attempt this. No CISA KEV listing and no EPSS score were provided in the source intelligence, so large-scale automated exploitation is not confirmed. For applications enforcing IP-based access controls, the effective risk is higher than the 6.9 score suggests because the bypass is trivial and requires no special tooling.

An attacker targets a Go microservice using chi's RealIP middleware to enforce an IP allowlist on an administrative API endpoint. The attacker sends an HTTP request with the header 'X-Forwarded-For: 10.10.1.5, <attacker-ip>', where 10.10.1.5 is a known permitted internal address. The chi middleware extracts the leftmost value, rewrites Request.RemoteAddr to 10.10.1.5, and the allowlist check passes - granting the attacker access to the restricted endpoint without ever holding a permitted IP. The published PoC in GHSA-9g5q-2w5x-hmxf demonstrates this with a two-line curl command requiring no special tooling.