CVE-2025-71405: go-chi chi before v5.2.2 Open Redirect via RedirectSlashes
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
chito a version that resolves this vulnerability.Fixed in v5.2.2Patch go-chi chi before v5.2.2 Open Redirect via RedirectSlashes
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71405?
The severity of CVE-2025-71405 is rated at 37, indicating a significant risk for systems using affected versions of chi.
How do I fix CVE-2025-71405?
To fix CVE-2025-71405, upgrade chi to version 5.2.2 or later where the vulnerability has been resolved.
What type of vulnerability is CVE-2025-71405?
CVE-2025-71405 is an open redirect vulnerability that can be exploited to redirect users to arbitrary malicious websites.
Who is affected by CVE-2025-71405?
Any application using chi versions before 5.2.2 is affected by CVE-2025-71405.
What can attackers do with CVE-2025-71405?
Attackers can exploit CVE-2025-71405 to redirect users, facilitating phishing and potentially stealing user credentials.