ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-72815

chi Has an IP Spoofing Vulnerability in

Published Jun 25, 2026 · catalog updated Nov 4, 2026 · chi Has an IP

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-72815. EPSS is 0.50%. Act only if a listed version of chi Has an IP is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (chi Has an IP).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.50%
Remediation
Advisory link
Affected products
Go github.com/go-chi/chi/v5 · Go github.com/go-chi/chi/v5/middleware

## Summary The middleware in is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the HTTP header. This allows a remote attacker to bypass IP-based access control lists (ACLs) and rate-limiting mechanisms by providing a spoofed IP address in the header. ## Details In , the function parses the header and extracts the first comma-separated value: Standard practice for is that each proxy appends the client's IP to the end of the list. However, since the client can also provide this header, the leftmost values are untrusted. A client can send a header like , and will treat as the source of the request. ## Proof of Concept (PoC) The following code demonstrates how an attacker can bypass an IP-based restriction. ## Impact An attacker can masquerade as any IP address. This can lead to: - **Bypass of Authentication/Authorization:** Accessing administrative panels or private APIs restricted by IP. - **Rate Limiting Evasion:** Circumbeting rate limiters that use as a key. - **Log Forgery:** Causing incorrect IP addresses to be recorded in security logs. ## CWE - **CWE-290:** Authentication Bypass by Spoofing - **CWE-345:** Insufficient Verification of Data Authenticity ## CVSS Score - **CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N** (6.9 Moderate) ## Affected Versions - <= (and all previous versions) ## Recommendation 1. **Stop using ** if you cannot guarantee that the incoming request headers are from a trusted source and have been sanitized by a proxy. 2. Implement a trust-based IP extraction mechanism that verifies the chain of proxies. 3. Use the header by traversing it from **right to left** and stopping at the first IP address that is not in your list of trusted proxies. ## Suggested Fix A secure implementation of should allow developers to specify a list of trusted proxy IP ranges (CIDRs). Below is a conceptual example of how to fix this by traversing the header from right to left: By providing a configuration like ,

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/go-chi/chi/v55.2.1 → 5.3.0
  • Go github.com/go-chi/chi/v5/middleware5.2.1 → 5.3.0

How to fix CVE-2026-72815

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-72815. EPSS is 0.50%. Act only if a listed version of chi Has an IP is installed.

Which versions are affected?

Compare what you have installed with 5.2.1 → 5.3.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-290: Authentication Bypass by Spoofing; CWE-345: Insufficient Verification of Data Authenticity. EPSS 0.50%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 25, 2026 · GitHub Advisory Database

    Detected

    ## Summary The middleware in is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the HTTP header. This allows a remote attacker to bypass IP-based access control lists (ACLs) and rate-limiting mechanisms by providing a spoofed IP address in the header. ## Details In , the function parses the header and extracts the first comma-separated value: Standard practice f

  2. Nov 4, 2026 · GitHub Advisory Database

    Fix available

    github.com/go-chi/chi/v5/middleware fixed in 5.3.0; github.com/go-chi/chi/v5 fixed in 5.3.0

  3. Nov 4, 2026 · GitHub Advisory Database

    Fix available

    github.com/go-chi/chi/v5/middleware fixed in 5.3.0

  4. Nov 4, 2026 · GitHub Advisory Database

    Fix available

    github.com/go-chi/chi/v5 fixed in 5.3.0

  5. Nov 4, 2026 · GitHub Advisory Database

    Updated

    ## Summary The middleware in is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the HTTP header. This allows a remote attacker to bypass IP-based access control lists (ACLs) and rate-limiting mechanisms by providing a spoofed IP address in the header. ## Details In , the function parses the header and extracts the first comma-separated value: Standard practice f

Sources

References

Freshness

Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Go Vulnerability DatabaseNov 5, 2026
  • CVE.orgNov 4, 2026
  • GitHub Advisory DatabaseNov 4, 2026
  • OpenSSF OSV / OSV ScannerNov 4, 2026