{"id":"CVE-2025-69725","aliases":["DEBIAN-CVE-2025-69725","EUVD-2025-207653","GHSA-4h76-926q-wxxw","GHSA-mqqf-5wvp-8fh8","GO-2026-4316","ROOT-APP-GOBINARY-CVE-2025-69725","SUSE-SU-2026:2830-1","UBUNTU-CVE-2025-69725","openSUSE-SU-2026:10239-1","openSUSE-SU-2026:10651-1","openSUSE-SU-2026:20702-1","openSUSE-SU-2026:20809-1","openSUSE-SU-2026:21151-1"],"status":"published","title":"Duplicate Advisory: chi has an open redirect vulnerability in the RedirectSlashes middleware","description":"An Open Redirect vulnerability in the go-chi/chi \u003e=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:C/UI:R","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00258,"percentile":0.17579,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2026-01-14T21:18:06Z","modified":"2026-11-05T21:32:22Z","fixes":[{"ecosystem":"Go","package":"github.com/go-chi/chi/v5","fixed_in":["5.2.4"],"sources":["ghsa"]},{"ecosystem":"Debian:14","package":"golang-github-go-chi-chi","fixed_in":["5.2.5-1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/go-chi/chi/v5","fixed_in":["v5.2.3-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/go-chi/chi/v5","fixed_in":["v5.2.3-aikido.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"warewulf4","fixed_in":["4.6.5-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/go-chi/chi/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.2"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-1"}]}],"versions":["5.2.0-1","5.2.3-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"5.2.2"},{"fixed":"5.2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"5.2.2"},{"fixed":"5.2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/go-chi/chi/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v5.2.3-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"github.com/go-chi/chi/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v5.2.3-aikido.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"warewulf4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-150500.6.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"warewulf4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-150500.6.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"warewulf4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-150500.6.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"warewulf4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-150500.6.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.1-2","5.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.3-1","5.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.0-1","5.2.3-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"warewulf4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.70.0-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"warewulf4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-bp160.1.1"}]}],"bundled":5}],"references":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8","tags":["advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69725","tags":["advisory"]},{"url":"http://go-chichi.com","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-4h76-926q-wxxw"},{"url":"https://github.com/go-chi/chi/issues/1037","tags":["web","report"]},{"url":"https://github.com/go-chi/chi/commit/6eb35881c0e438ffb663ddbad3a61babaa5e5d8a","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-mqqf-5wvp-8fh8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122132.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122132","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-5.2.2-through-5.5.0-open-redirect-via-redirectslashes-middleware","tags":["advisory"]},{"url":"https://github.com/go-chi/chi/pull/1238","tags":["fix"]},{"url":"https://github.com/go-chi/chi","tags":["package"]},{"url":"https://github.com/go-chi/chi/blob/v5.5.0/middleware/strip.go#L41-L69","tags":["article"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-69725","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262830-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254470","tags":["report"]},{"url":"https://bugzilla.suse.com/1258511","tags":["report"]},{"url":"https://bugzilla.suse.com/1262810","tags":["report"]},{"url":"https://bugzilla.suse.com/1265653","tags":["report"]},{"url":"https://bugzilla.suse.com/1266483","tags":["report"]},{"url":"https://bugzilla.suse.com/1268790","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-69725","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69725","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39984","tags":["web"]},{"url":"https://bugzilla.suse.com/1258094","tags":["report"]},{"url":"https://bugzilla.suse.com/1258513","tags":["report"]},{"url":"https://bugzilla.suse.com/1260193","tags":["report"]},{"url":"https://bugzilla.suse.com/1260971","tags":["report"]},{"url":"https://bugzilla.suse.com/1261052","tags":["report"]},{"url":"https://bugzilla.suse.com/1262389","tags":["report"]},{"url":"https://bugzilla.suse.com/1262893","tags":["report"]},{"url":"https://bugzilla.suse.com/1255366","tags":["report"]},{"url":"https://bugzilla.suse.com/1264873","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-69725","description":"An Open Redirect vulnerability in the go-chi/chi \u003e=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.","status":"published","published":"2026-02-19T00:00:00Z","modified":"2026-07-05T01:29:10.47Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:C/UI:R","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:32:40.774223Z"}],"euvd":[{"id":"EUVD-2025-207653","description":"An Open Redirect vulnerability in the go-chi/chi \u003e=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.","status":"published","published":"2026-02-19T00:00:00Z","modified":"2026-07-05T01:29:10Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:C/UI:R","level":"medium"}],"updated_at":"2026-11-02T18:20:14.793418Z"}],"ghsa":[{"id":"GHSA-4h76-926q-wxxw","title":"Duplicate Advisory: chi has an open redirect vulnerability in the RedirectSlashes middleware","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-mqqf-5wvp-8fh8. This link is maintained to preserve external references.\n\n### Original Description\nAn Open Redirect vulnerability in the go-chi/chi \u003e=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.","status":"withdrawn","published":"2026-02-19T18:31:54Z","modified":"2026-06-18T13:01:48Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:40:28.438722Z"},{"id":"GHSA-mqqf-5wvp-8fh8","title":"chi has an open redirect vulnerability in the RedirectSlashes middleware","description":"### Summary\n\nThe `RedirectSlashes` function in middleware/strip.go does not perform correct input validation and can lead to an open redirect vulnerability.\n\n### Details\n\nThe `RedirectSlashes` function performs a `Trim` to all forward slash (`/`) characters, while prepending a single one at the begining of the path (Line 52).\n\nHowever, it does not trim backslashes (`\\`).\n\n```go\nFile: middleware/strip.go\n41: func RedirectSlashes(next http.Handler) http.Handler {\n...\n51: \t\t\t// Trim all leading and trailing slashes (e.g., \"//evil.com\", \"/some/path//\")\n52: \t\t\tpath = \"/\" + strings.Trim(path, \"/\")\n...\n62: }\n```\n\nAlso, from version 5.2.2 onwards the `RedirectSlashes` function does not take into consideration the `Host` Header in the redirect response returned. This was done in order to combat another [[vulnerability](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93)](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93).\n\nThe above make it possible for a response in the following form:\n\n```\nHTTP/1.1 301 Moved Permanently\nLocation: /\\evil.com\n```\n\nThe `/\\evil.com` will be transformed by most browsers (Chrome, Firefox, etc. not Safari) into `//evil.com` which is a protocol relative URL and will result in a redirect to `evil.com`, essentially making it an open redirect vulnerability.\n\n### PoC\n\nA minimal working example can be seen below.\n\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"net/http\"\n\n\t\"github.com/go-chi/chi/v5\"\n\t\"github.com/go-chi/chi/v5/middleware\"\n)\n\n\n\nfunc main() {\n\tr := chi.NewRouter()\n\n\tr.Use(middleware.RedirectSlashes)\n\n\tr.Get(\"/*\", func(w http.ResponseWriter, r *http.Request) {\n\t\tw.WriteHeader(http.StatusOK)\n\t})\n\n\tfmt.Println(\"Server starting on port 8081...\")\n\tif err := http.ListenAndServe(\":8081\", r); err != nil {\n\t\tfmt.Printf(\"Error starting server: %v\\n\", err)\n\t}\n}\n\n```\n\nAnd when we request the path `/\\evil.com` (needs a second backslash or URL encoding in the terminal), the HTTP Redirect Location is just `/\\evil.com` without any domain/Host information.\n\n```bash\n$ curl -I  localhost:8081/\\\\evil.com/\nHTTP/1.1 301 Moved Permanently\nContent-Type: text/html; charset=utf-8\nLocation: /\\evil.com\n```\n\n```bash\n$ curl -I  localhost:8081/%5Cevil.com/\nHTTP/1.1 301 Moved Permanently\nContent-Type: text/html; charset=utf-8\nLocation: /\\evil.com\n```\n\nThis opened in a browser (Chrome, Firefox) will result in a transformation to `//evil.com` which in turn will result in a redirect to `evil.com`.\n\u003cimg width=\"200\" alt=\"image-20250829115619807\" src=\"https://github.com/user-attachments/assets/44aedad1-64b6-4660-8b26-fad9b4eca036\" /\u003e\n\n\n\u003cimg width=\"200\" alt=\"image-20250829115632067\" src=\"https://github.com/user-attachments/assets/b976d47d-1975-469c-abd3-deb907a68db2\" /\u003e\n\n\n### Impact\n\nThis essentially consists of an open redirect vulnerability, provided that victim users use the most popular browsers (Chrome, Firefox, etc. It does not work in e.g. Safari).\n\nThe attacker can construct a malicious URL on a domain of a legitimate website and send it to the victim user. The victim users thinking that they will click on a legitimate website's URL, they will unknowingly be reidrected to an attacker controlled website.\n\nThis can lead to credential theft if the victim gets redirected to a phishing website, to malware that is hosted on the attacker controlled website etc. Also, it has a greate reputation / business impact for the affected legitimate website.\n\nIn order to exploit this vulnerability the attacker does not need to be authenticated or have ay other priviledge / knowledge regarding the affected application.\n\nCVSS Score: [4.7 (Medium)](https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N)","status":"published","published":"2026-01-14T21:18:06Z","modified":"2026-06-18T13:02:20Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:40:28.438722Z"}],"nvd":[{"id":"CVE-2025-69725","description":"An Open Redirect vulnerability in the go-chi/chi \u003e=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.","status":"published","published":"2026-02-19T17:24:39.83Z","modified":"2026-07-05T02:17:37.113Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:12:00.273026Z"}],"osv":[{"id":"CVE-2025-69725","description":"An Open Redirect vulnerability in the go-chi/chi \u003e=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.","status":"published","published":"2026-02-19T17:24:39.83Z","modified":"2026-11-05T10:55:55.386587623Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"CVE-2026-122132","title":"go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware","description":"go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.","status":"published","published":"2026-11-04T20:36:51.758Z","modified":"2026-11-07T02:30:43.02569382Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-07T03:08:01.726202Z"},{"id":"DEBIAN-CVE-2025-69725","description":"An Open Redirect vulnerability in the go-chi/chi \u003e=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.","status":"published","published":"2026-02-19T17:24:39.83Z","modified":"2026-09-01T20:05:58.394979973Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"GHSA-4h76-926q-wxxw","title":"Duplicate Advisory: chi has an open redirect vulnerability in the RedirectSlashes middleware","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-mqqf-5wvp-8fh8. This link is maintained to preserve external references.\n\n### Original Description\nAn Open Redirect vulnerability in the go-chi/chi \u003e=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.","status":"withdrawn","published":"2026-02-19T18:31:54Z","modified":"2026-06-18T13:16:10.637031167Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"GHSA-mqqf-5wvp-8fh8","title":"chi has an open redirect vulnerability in the RedirectSlashes middleware","description":"### Summary\n\nThe `RedirectSlashes` function in middleware/strip.go does not perform correct input validation and can lead to an open redirect vulnerability.\n\n### Details\n\nThe `RedirectSlashes` function performs a `Trim` to all forward slash (`/`) characters, while prepending a single one at the begining of the path (Line 52).\n\nHowever, it does not trim backslashes (`\\`).\n\n```go\nFile: middleware/strip.go\n41: func RedirectSlashes(next http.Handler) http.Handler {\n...\n51: \t\t\t// Trim all leading and trailing slashes (e.g., \"//evil.com\", \"/some/path//\")\n52: \t\t\tpath = \"/\" + strings.Trim(path, \"/\")\n...\n62: }\n```\n\nAlso, from version 5.2.2 onwards the `RedirectSlashes` function does not take into consideration the `Host` Header in the redirect response returned. This was done in order to combat another [[vulnerability](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93)](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93).\n\nThe above make it possible for a response in the following form:\n\n```\nHTTP/1.1 301 Moved Permanently\nLocation: /\\evil.com\n```\n\nThe `/\\evil.com` will be transformed by most browsers (Chrome, Firefox, etc. not Safari) into `//evil.com` which is a protocol relative URL and will result in a redirect to `evil.com`, essentially making it an open redirect vulnerability.\n\n### PoC\n\nA minimal working example can be seen below.\n\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"net/http\"\n\n\t\"github.com/go-chi/chi/v5\"\n\t\"github.com/go-chi/chi/v5/middleware\"\n)\n\n\n\nfunc main() {\n\tr := chi.NewRouter()\n\n\tr.Use(middleware.RedirectSlashes)\n\n\tr.Get(\"/*\", func(w http.ResponseWriter, r *http.Request) {\n\t\tw.WriteHeader(http.StatusOK)\n\t})\n\n\tfmt.Println(\"Server starting on port 8081...\")\n\tif err := http.ListenAndServe(\":8081\", r); err != nil {\n\t\tfmt.Printf(\"Error starting server: %v\\n\", err)\n\t}\n}\n\n```\n\nAnd when we request the path `/\\evil.com` (needs a second backslash or URL encoding in the terminal), the HTTP Redirect Location is just `/\\evil.com` without any domain/Host information.\n\n```bash\n$ curl -I  localhost:8081/\\\\evil.com/\nHTTP/1.1 301 Moved Permanently\nContent-Type: text/html; charset=utf-8\nLocation: /\\evil.com\n```\n\n```bash\n$ curl -I  localhost:8081/%5Cevil.com/\nHTTP/1.1 301 Moved Permanently\nContent-Type: text/html; charset=utf-8\nLocation: /\\evil.com\n```\n\nThis opened in a browser (Chrome, Firefox) will result in a transformation to `//evil.com` which in turn will result in a redirect to `evil.com`.\n\u003cimg width=\"200\" alt=\"image-20250829115619807\" src=\"https://github.com/user-attachments/assets/44aedad1-64b6-4660-8b26-fad9b4eca036\" /\u003e\n\n\n\u003cimg width=\"200\" alt=\"image-20250829115632067\" src=\"https://github.com/user-attachments/assets/b976d47d-1975-469c-abd3-deb907a68db2\" /\u003e\n\n\n### Impact\n\nThis essentially consists of an open redirect vulnerability, provided that victim users use the most popular browsers (Chrome, Firefox, etc. It does not work in e.g. Safari).\n\nThe attacker can construct a malicious URL on a domain of a legitimate website and send it to the victim user. The victim users thinking that they will click on a legitimate website's URL, they will unknowingly be reidrected to an attacker controlled website.\n\nThis can lead to credential theft if the victim gets redirected to a phishing website, to malware that is hosted on the attacker controlled website etc. Also, it has a greate reputation / business impact for the affected legitimate website.\n\nIn order to exploit this vulnerability the attacker does not need to be authenticated or have ay other priviledge / knowledge regarding the affected application.\n\nCVSS Score: [4.7 (Medium)](https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N)","status":"published","published":"2026-01-14T21:18:06Z","modified":"2026-11-05T10:55:55.386587623Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"UBUNTU-CVE-2025-69725","description":"An Open Redirect vulnerability in the go-chi/chi \u003e=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.","status":"published","published":"2026-02-19T17:24:00Z","modified":"2026-10-17T12:58:39.2350908Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"GO-2026-4316","title":"Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi","description":"Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi","status":"published","published":"2026-01-23T02:28:11Z","modified":"2026-11-05T10:55:55.386587623Z","updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"openSUSE-SU-2026:10239-1","title":"warewulf4-4.6.5-2.1 on GA media","description":"These are all security issues fixed in the warewulf4-4.6.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-23T00:00:00Z","modified":"2026-03-23T04:54:36.885159Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10651-1","title":"trivy-0.70.0-1.1 on GA media","description":"These are all security issues fixed in the trivy-0.70.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-28T00:00:00Z","modified":"2026-04-29T08:02:21.606323Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20702-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\nChanges in trivy:\n\n- Update to version 0.70.0 (\n     bsc#1260193, CVE-2026-33186,\n     bsc#1260971, CVE-2026-33747,\n     bsc#1261052, CVE-2026-33748,\n     bsc#1262389, CVE-2026-39984,\n     bsc#1262893, CVE-2026-34986):\n  * release: v0.70.0 [main] (#10105)\n  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 (#10496)\n  * chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 (#10526)\n  * chore(deps): bump the common group across 1 directory with 8 updates (#10540)\n  * chore(deps): bump the docker group across 1 directory with 2 updates (#10538)\n  * fix: use Development category for GoReleaser discussions (#10530)\n  * chore(deps): bump testcontainers-go to v0.42.0 (#10531)\n  * chore: update CODEOWNERS (#10529)\n  * chore(deps): bump helm.sh/helm/v3 from 3.20.1 to 3.20.2 (#10511)\n  * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 (#10510)\n  * chore(deps): bump github.com/moby/buildkit from 0.27.1 to 0.28.1 (#10449)\n  * ci: migrate from mkdocs-material-insiders to mkdocs-material (#10509)\n  * chore: remove aquasecurity/homebrew-trivy tap from GoReleaser (#10508)\n  * ci: update runners for workflows that interact with GitHub API (#10502)\n  * ci: rename tokens and update runners (#10500)\n  * ci: trigger helm chart publishing via helm-charts workflow (#10474)\n  * ci: remove ruleset update step from release-please workflow (#10499)\n  * ci: use large runner and replace ORG_REPO_TOKEN in release-please workflow (#10498)\n  * ci: trigger rpm/deb deployment via trivy-repo workflow (#10476)\n  * fix: remove os.Stdout from wazero module config (#10403)\n  * chore(deps): bump the common group across 1 directory with 22 updates (#10408)\n  * chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#10407)\n  * fix(flag): validate template file extension (#10296)\n  * fix(sbom): preserve Red Hat BuildInfo when scanning SBOMs without layer info (#10378)\n  * fix: handle Go 1.26 GOEXPERIMENT version format change (#10351)\n  * fix(python): handle multiple version specifiers in requirements.txt (#10361)\n  * ci: run Trivy version bump in trivy-action (#10272)\n  * fix(python): nil pointer dereference with optional poetry groups without dependencies (#10359)\n  * ci: replace personal email with github-actions[bot] in workflows (#10369)\n  * chore: replace smithy epoch parsing with stdlib time.Unix (#10286)\n  * test: update golden files for purl changes (#10372)\n  * ci: add zizmor to scan GitHub Actions workflows (#10322)\n  * refactor: log statuses as strings (#10285)\n  * ci: add build provenance attestations for release artifacts (#10316)\n  * fix(sbom): add NOASSERTION for licenseDeclared/licenseConcluded in SPDX non-library packages (#10368)\n  * fix(report): set correct sarif ROOTPATH uri when scanning a git repository (#10366)\n  * perf(plugin): optimize directory traversal by replacing filepath.Walk with filepath.WalkDir (#10325)\n  * docs: correct typos in CHANGELOG and diagram (#10320)\n  * chore: delete roadmap wf (#10295)\n  * ci(helm): bump Trivy version to 0.69.3 for Trivy Helm Chart 0.21.3 (#10310)\n  * fix(cyclonedx): include CVSS v4 vulnerability ratings (#10313)\n  * fix: detected vulnerability fields in azure and mariner detector (#10275)\n  * ci: add persist-credentials: false to checkout steps (#10306)\n  * ci(helm): bump Trivy version to 0.69.2 for Trivy Helm Chart 0.21.2 (#10270)\n  * chore(deps): bump the common group across 1 directory with 8 updates (#10248)\n  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#10257)\n  * chore(deps): bump the aws group across 1 directory with 6 updates (#10249)\n  * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#10241)\n  * ci: remove apidiff workflow (#10259)\n  * chore(deps): bump github.com/docker/cli from 29.1.4+incompatible to 29.2.1+incompatible in the docker group across 1 directory (#10221)\n  * ci: bump golangci-lint to v2.10 in cache-test-assets (#10243)\n  * feat(java): add support for proxy configuration from Maven settings.xml (#10187)\n  * chore(deps): bump the github-actions group across 3 directories with 11 updates (#10242)\n  * feat(python): add pylock.toml support (#10137)\n  * chore: bump SPDX license IDs and exceptions to `v3.28.0` (#10233)\n  * docs: fix typos and upgrade insecure HTTP links to HTTPS (#10219)\n  * chore: bump golangci-lint to v2.10.0 (#10223)\n  * feat(misconf): support for azurerm_network_interface_security_group_association  (#10215)\n  * ci: pin Docker Engine to v29 for integration tests (#10232)\n  * feat(go): detect version from ELF symbol table for binaries built with -trimpath (#10197)\n  * docs: migrate private registry documentation from GCR to GAR (#10208)\n  * chore(deps): bump the common group across 1 directory with 24 updates (#10206)\n  * chore(deps): update Docker client SDK to v29 (#10202)\n  * test: update Docker Engine integration tests for Docker API v0.29.0+ compatibility (#10199)\n  * fix(misconf): initialize custom annotation field if empty (#10123)\n  * feat(ubuntu): add eol data for 25.10 (#10181)\n  * docs: fix incorrect count of Python package managers (#10175)\n  * chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 (#10179)\n  * feat(misconf): resolve Azure resources via resource_id (#10173)\n  * ci(helm): bump Trivy version to 0.69.1 for Trivy Helm Chart 0.21.1 (#10155)\n  * refactor: remove unused Insecure field from ServiceOption (#10113)\n  * refactor: reduce complexity of init in detect.go (#10163)\n  * feat(misconf): adapt ARM k8s clusters (#9696) (#10125)\n  * docs: update version endpoint example in client/server documentation (#10151)\n  * feat(vuln): skip third-party packages in common Detect function (#10129)\n  * ci: add composite action for Go setup (#10146)\n  * fix(misconf): apply check aliases when filtering results via .trivyignore (#10112)\n  * docs(terraform): add limitation for data sources and computed resource attributes (#10128)\n  * fix: update PhotonOS feed URL (#10122)\n  * feat(server): include server version info in JSON output for client/server mode (#10075)\n  * chore(deps): bump to alpine:3.23.3 and go-1.25.6 to fix CVEs (#10107)\n  * refactor: unify scanner error limit and compiler limit (#10106)\n  * ci(helm): bump Trivy version to 0.69.0 for Trivy Helm Chart 0.21.0 (#10103)\n  * fix(java): Disable overwriting exclusions (#10088)\n  * refactor(rust): use txtar format for cargo analyzer test data (#10104)\n  * feat(python): add pylock.toml (PEP 751) parser (#9632)\n  * chore(deps): bump the aws group across 1 directory with 6 updates (#10068)\n  * fix(server): exclude JavaDB and CheckBundle from /version endpoint (#10100)\n\n- Update to version 0.69.3 (CVE-2026-25934, bsc#1258094):\n  * release: v0.69.3 [release/v0.69] (#10293)\n  * fix(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 [backport: release/v0.69] (#10291)\n  * release: v0.69.2 [release/v0.69] (#10266)\n  * fix(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 [backport: release/v0.69] (#10267)\n  * fix(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 [backport: release/v0.69] (#10264)\n  * ci: remove apidiff workflow\n  * release: v0.69.1 [release/v0.69] (#10145)\n  * ci: add composite action for Go setup [backport: release/v0.69] (#10150)\n  * fix(misconf): apply check aliases when filtering results via .trivyignore [backport: release/v0.69] (#10143)\n  * chore(deps): bump to alpine:3.23.3 and go-1.25.6 to fix CVEs [backport: release/v0.69] (#10135)\n","status":"withdrawn","published":"2026-05-06T11:33:27Z","modified":"2026-06-24T14:04:22.237027362Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20809-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues\n\n- CVE-2025-64702: github.com/quic-go/quic-go/http3: quic-go HTTP/3 QPACK Header Expansion DoS (bsc#1255366).\n- CVE-2025-69725: github.com/go-chi/chi/v5: incorrect input validation in the RedirectSlashes function can lead to an\n  open redirect (bsc#1258513).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258094).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260193).\n- CVE-2026-33747: github.com/moby/buildkit: malicious frontends can craft API messages that cause files to be written\n  outside of the BuildKit state directory (bsc#1260971).\n- CVE-2026-33748: github.com/moby/buildkit: insufficient validation of Git URL fragment subdir components may allow\n  access to files outside the checked-out Git repository (bsc#1261052).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262893).\n- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be\n  used to bypass some authorization controls (bsc#1262389).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264873).\n\nChanges for trivy:\n\n- Updated go-git to 5.18.0.\n- Updated to version 0.70.0.\n","status":"published","published":"2026-05-17T21:24:43Z","modified":"2026-05-29T18:24:10.270635001Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21151-1","title":"Security update for warewulf4","description":"This update for warewulf4 fixes the following issues:\n\nChanges in warewulf4:\n\n- updated go-jose to fix CVE-2026-34986 (bsc#1262810)\n- chi is fixed in the upstream project\n\n- updating to v4.7.0 with following security fixes\n * fixed CVE-2026-39821 (bsc#1266483)\n * fixed CVE-2026-33814 (bsc#1265653)\n- v4.7.0 with significant changes relative to the v4.6.x series which are:\n  * New wwctl unset command\n  * Refactored server routes (URLs)\n  * New /files/ route for serving individual files and templates\n  * Server TLS support\n  * Removed support for fetching individual overlays and individual files from overlays\n  * Fixed whitespace handling around template functions\n  * Security fixes, including updated Go and library versions\n- changes from v4.6.5:\n  * new wwctl overlay info command\n  * fixed wwctl image import --update option\n  * cross-arch support for wwclient\n  * improved IPv6 support\n  * improved support for bonded interfaces\n  * renamed debian.interfaces overlay to ifupdown\n  * new systemd-networkd overlay\n  * warewulf-dracut fixes, including \"provision-to-disk\" fixes\n- remove slurm-overlay package\n\n- fix CVE-2025-69725 (bsc#1258511) by updating chi\n\n- updated to v4.6.5 with following changes:\n  * new wwctl overlay info command\n  * fixed wwctl image import --update option (bsc#1254470)\n  * cross-arch support for wwclient\n  * improved IPv6 support\n  * improved support for bonded interfaces\n  * renamed debian.interfaces overlay to ifupdown\n  * new systemd-networkd overlay\n  * warewulf-dracut fixes, including \"provision-to-disk\" fixes\n- default to dnsmasq instead of dhcpd and tftp\n","status":"published","published":"2026-06-23T09:37:25Z","modified":"2026-06-30T18:24:45.673043944Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-APP-GOBINARY-CVE-2025-69725","title":"CVE-2025-69725 in rootio-github.com/go-chi/chi/v5 - Patched by Root","description":"Root has patched CVE-2025-69725 in the rootio-github.com/go-chi/chi/v5 package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-07-22T10:39:42Z","modified":"2026-07-22T14:00:19.94854313Z","updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"SUSE-SU-2026:2830-1","title":"Security update for warewulf4","description":"This update for warewulf4 fixes the following issues:\n\nUpdate to v4.7.0.\n\nSecurity issues fixed:\n\n- CVE-2025-69725: incorrect input validation in the `RedirectSlashes` function can lead to an open redirect\n  (bsc#1258511).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad `SETTINGS_MAX_FRAME_SIZE`\n  can lead to a denial of service (bsc#1265653).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262810).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266483).\n\nOther updates and bugfixes:\n\n- Add correct flag `--update-overlays` fix (bsc#1268790).  \n- v4.7.0:\n  * New `wwctl` unset command\n  * Refactored server routes (URLs)\n  * New `/files/` route for serving individual files and templates\n  * Server TLS support\n  * Removed support for fetching individual overlays and individual files from overlays\n  * Fixed whitespace handling around template functions\n  * Security fixes, including updated Go and library versions\n- v4.6.5:\n  * New wwctl overlay info command\n  * Fixed `wwctl` image import `--update` option\n  * Cross-arch support for `wwclient`\n  * Improved IPv6 support\n  * Improved support for bonded interfaces\n  * Renamed `debian.interfaces` overlay to `ifupdown`\n  * New `systemd-networkd` overlay\n  * `warewulf-dracut` fixes, including `provision-to-disk` fixes\n- Remove `slurm-overlay` package.\n- Fix `wwctl` image import `--update` option (bsc#1254470).\n","status":"published","published":"2026-07-09T18:42:09Z","modified":"2026-07-10T10:00:08.966223157Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}