CVE-2026-72817: go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go-chi/chito a version that resolves this vulnerability.Fixed in 5.3.0 - Configuration
Update the RealIP middleware configuration so it only uses the first X-Forwarded-For IP when the request is coming from a trusted proxy; otherwise fall back to Request.RemoteAddr and do not use unvalidated X-Forwarded-For.
go-chi chi RealIP middleware X-Forwarded-For handling / trusted proxies validation = Enable validation of trusted proxies (do not trust the first X-Forwarded-For IP unless the proxy is trusted)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72817?
The severity of CVE-2026-72817 is rated as medium, with a score of 6.5.
How do I fix CVE-2026-72817?
To fix CVE-2026-72817, upgrade go-chi/chi to version 5.3.0 or later.
What type of vulnerability is CVE-2026-72817?
CVE-2026-72817 is an IP spoofing vulnerability related to the X-Forwarded-For header.
What impact does CVE-2026-72817 have on my system?
CVE-2026-72817 may allow a malicious client to spoof their IP address, potentially bypassing security controls.
Which versions of go-chi/chi are affected by CVE-2026-72817?
CVE-2026-72817 affects go-chi/chi versions 0.9.0 before 5.3.0.