CVE-2026-72815: go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go-chi chito a version that resolves this vulnerability.Fixed in 5.3.0 - Upgrade
Upgrade
go-chi chito a version that resolves this vulnerability.Fixed in 5.3.0Patch go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72815?
CVE-2026-72815 has a risk rating of 47, indicating a moderate level of severity.
How do I fix CVE-2026-72815?
To fix CVE-2026-72815, upgrade go-chi/chi to version 5.3.0 or later.
What systems are affected by CVE-2026-72815?
CVE-2026-72815 affects go-chi/chi versions greater than or equal to 5.2.1 and less than 5.3.0.
What kind of attack can exploit CVE-2026-72815?
CVE-2026-72815 can be exploited by remote attackers to bypass IP-based access controls and forge logs.
Which middleware in go-chi/chi is vulnerable in CVE-2026-72815?
The vulnerability in CVE-2026-72815 resides in the RealIP middleware of go-chi/chi.