DEBIAN-CVE-2026-118681: Low severity debian/golang-github-go-chi-chi vulnerability

Published Oct 28, 2026

Updated

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.

Affected Software

3 affected components

debian/golang-github-go-chi-chi*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go-chi/chi to a version that resolves this vulnerability.
Fixed in 5.5.0

Event History

Oct 28, 2026

CVE Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed?

Exposure requires an application using a vulnerable go-chi chi version before 5.5.0 with middleware.SupressNotFound, a mounted router protected by authentication middleware, and an outer public route whose handler trusts a retained mount parameter. The issue can allow retrieval of tenant-scoped data under that route arrangement.

What does an attacker need to exploit this issue?

An attacker does not need authentication or user interaction, but must be able to send a request to a mounted path whose suffix matches an outer public route. Exploitation depends on the routing configuration and on the outer handler trusting the retained mount parameter.

Are default installations affected?

The available information does not establish that a default configuration is affected. The vulnerable behavior is tied to use of middleware.SupressNotFound and a specific mounted-router and outer-public-route configuration.

DEBIAN-CVE-2026-118681: Low severity debian/golang-github-go-chi-chi vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to exploit this issue?

Are default installations affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to exploit this issue?

Are default installations affected?