CVE-2026-72817

Name of the Vulnerable Software and Affected Versions go-chi/chi versions 0.9.0 through 5.2.9

Description The RealIP middleware resolves the request source IP (Request.RemoteAddr) by using the first IP address found in the X-Forwarded-For header without validating trusted proxies. This allows a malicious client to prepend a forged IP address as the first value of the X-Forwarded-For header to spoof the request source IP, which may lead to the bypass of access controls or the falsification of request logs.

Recommendations Update go-chi/chi to version 5.3.0 or later.