CVE-2026-72816

Name of the Vulnerable Software and Affected Versions go-chi/chi versions prior to 5.3.0

Description The RealIP middleware (middleware/realip.go) allows IP spoofing because the realIP() function reads client-controlled headers and overwrites r.RemoteAddr without verifying if the request came from a trusted proxy. Affected headers include True-Client-IP, X-Real-IP, and X-Forwarded-For. This allows attackers to provide arbitrary IP addresses to bypass IP-based access controls, evade geo-IP restrictions and rate limiting, and pollute audit logs.

Recommendations Update to version 5.3.0. As a temporary mitigation, restrict the use of the RealIP middleware until the update is applied.