Go Chi
Monthly
IP spoofing in Go Chi before 5.4.0 allows an unauthenticated client that can reach the Go server directly to forge its apparent source address through the opt-in ClientIPFromXFF middleware. The middleware skips X-Forwarded-For entries that fall inside a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that same CIDR, so an attacker can append a trusted-looking proxy address and control the value returned by middleware.GetClientIP. This is a moderate-severity logic flaw (CWE-348) that matters only where applications use the derived client IP for allowlisting, rate limiting, geolocation, or audit logging; no public exploit identified at time of analysis.
IP spoofing in go-chi's RealIP middleware allows unauthenticated network attackers to forge the apparent client source IP by prepending an arbitrary value to the X-Forwarded-For header, because the middleware blindly trusts the leftmost entry rather than walking the header right-to-left past trusted proxies. Applications that use middleware.RealIP() for IP-based access control or audit logging are directly exposed across all major version branches (v1 through v5 before 5.3.0). A working proof-of-concept is published in the GitHub Security Advisory GHSA-9g5q-2w5x-hmxf; no CISA KEV listing at time of analysis.
IP spoofing in go-chi/chi's RealIP middleware through version 5.2.1 enables unauthenticated remote attackers to inject arbitrary values into the True-Client-IP, X-Real-IP, or X-Forwarded-For headers, which the middleware blindly accepts and uses to overwrite r.RemoteAddr without any trusted-proxy verification. Applications that rely on r.RemoteAddr for IP-based access controls, rate limiting, or geo-IP restrictions are directly bypassed, and audit logs are silently corrupted with attacker-chosen addresses. A public proof-of-concept is confirmed in the GitHub Security Advisory GHSA-rjr7-jggh-pgcp; no CISA KEV listing at time of analysis.
IP spoofing via the RealIP middleware in go-chi/chi (versions 5.2.1 through 5.2.x) allows unauthenticated remote attackers to bypass IP-based access control lists, circumvent rate-limiting mechanisms, and forge log entries by prepending a fabricated address to the X-Forwarded-For HTTP header. A proof-of-concept is included in the GitHub security advisory (GHSA-3fxj-6jh8-hvhx), confirming exploitability against any chi application that enables the RealIP middleware and enforces controls based on the overwritten r.RemoteAddr. No active exploitation has been confirmed in CISA KEV at time of analysis.
Open redirect in chi (go-chi/chi) versions before 5.2.2 allows Host header injection via the RedirectSlashes middleware, enabling attackers to redirect users to arbitrary external domains for phishing and credential theft. Applications using the RedirectSlashes middleware that expose their chi router to environments where the Host header can be forged are directly at risk. No public exploit is identified in CISA KEV; however, a functional proof-of-concept is documented in the GHSA advisory, and the GHSA itself characterizes real-world exploitability as lower-severity because standard browsers and email clients cannot be used to manipulate the Host header.
IP spoofing in Go Chi before 5.4.0 allows an unauthenticated client that can reach the Go server directly to forge its apparent source address through the opt-in ClientIPFromXFF middleware. The middleware skips X-Forwarded-For entries that fall inside a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that same CIDR, so an attacker can append a trusted-looking proxy address and control the value returned by middleware.GetClientIP. This is a moderate-severity logic flaw (CWE-348) that matters only where applications use the derived client IP for allowlisting, rate limiting, geolocation, or audit logging; no public exploit identified at time of analysis.
IP spoofing in go-chi's RealIP middleware allows unauthenticated network attackers to forge the apparent client source IP by prepending an arbitrary value to the X-Forwarded-For header, because the middleware blindly trusts the leftmost entry rather than walking the header right-to-left past trusted proxies. Applications that use middleware.RealIP() for IP-based access control or audit logging are directly exposed across all major version branches (v1 through v5 before 5.3.0). A working proof-of-concept is published in the GitHub Security Advisory GHSA-9g5q-2w5x-hmxf; no CISA KEV listing at time of analysis.
IP spoofing in go-chi/chi's RealIP middleware through version 5.2.1 enables unauthenticated remote attackers to inject arbitrary values into the True-Client-IP, X-Real-IP, or X-Forwarded-For headers, which the middleware blindly accepts and uses to overwrite r.RemoteAddr without any trusted-proxy verification. Applications that rely on r.RemoteAddr for IP-based access controls, rate limiting, or geo-IP restrictions are directly bypassed, and audit logs are silently corrupted with attacker-chosen addresses. A public proof-of-concept is confirmed in the GitHub Security Advisory GHSA-rjr7-jggh-pgcp; no CISA KEV listing at time of analysis.
IP spoofing via the RealIP middleware in go-chi/chi (versions 5.2.1 through 5.2.x) allows unauthenticated remote attackers to bypass IP-based access control lists, circumvent rate-limiting mechanisms, and forge log entries by prepending a fabricated address to the X-Forwarded-For HTTP header. A proof-of-concept is included in the GitHub security advisory (GHSA-3fxj-6jh8-hvhx), confirming exploitability against any chi application that enables the RealIP middleware and enforces controls based on the overwritten r.RemoteAddr. No active exploitation has been confirmed in CISA KEV at time of analysis.
Open redirect in chi (go-chi/chi) versions before 5.2.2 allows Host header injection via the RedirectSlashes middleware, enabling attackers to redirect users to arbitrary external domains for phishing and credential theft. Applications using the RedirectSlashes middleware that expose their chi router to environments where the Host header can be forged are directly at risk. No public exploit is identified in CISA KEV; however, a functional proof-of-concept is documented in the GHSA advisory, and the GHSA itself characterizes real-world exploitability as lower-severity because standard browsers and email clients cannot be used to manipulate the Host header.