CVE-2026-72817: Go-Chi Chi

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.

Affected products

• Go-Chi Chi: from 0.9.0, before 5.3.0 (fixed in 5.3.0)

Published 2026-08-14. Last modified 2026-10-08.