CVE-2026-72816: go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go-chi/chito a version that resolves this vulnerability.Fixed in 5.3.0 - Compensating control
If upgrading is not immediately possible, configure your reverse proxy/load balancer so that only the proxy IPs are allowed to set or forward RealIP-related headers (True-Client-IP, X-Real-IP, X-Forwarded-For), and drop/ignore those headers from all other client traffic to prevent client-controlled header IP spoofing.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72816?
CVE-2026-72816 has a medium severity score of 6.5.
What type of vulnerability is CVE-2026-72816?
CVE-2026-72816 is an IP spoofing vulnerability caused by improper handling of client-controlled headers in the RealIP middleware.
How can I fix CVE-2026-72816?
To fix CVE-2026-72816, upgrade to go-chi/chi version 5.3.0 or later where the vulnerability has been addressed.
Who is affected by CVE-2026-72816?
CVE-2026-72816 affects users of go-chi/chi versions prior to 5.3.0 that utilize the RealIP middleware.
What header is exploited in CVE-2026-72816?
CVE-2026-72816 exploits headers like True-Client-IP, X-Real-IP, and X-Forwarded-For to manipulate the RemoteAddr field.