{"id":"CVE-2026-72816","aliases":["AZL-96635","AZL-96689","DEBIAN-CVE-2026-72816","EUVD-2026-58631","GHSA-rjr7-jggh-pgcp","GHSA-xg24-pmhh-m4m9","GO-2026-5777","RHSA-2026:49718","RHSA-2026:49732","RHSA-2026:54420","UBUNTU-CVE-2026-72816","openSUSE-SU-2026:21645-1","openSUSE-SU-2026:21653-1","openSUSE-SU-2026:21670-1","openSUSE-SU-2026:21793-1","openSUSE-SU-2026:21918-1"],"status":"published","title":"go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware","description":"go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.003,"percentile":0.23059,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290","CWE-348"],"published":"2026-06-25T18:19:15Z","modified":"2026-11-05T14:17:23Z","fixes":[{"ecosystem":"Go","package":"github.com/go-chi/chi/v5/middleware","fixed_in":["5.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"gh","fixed_in":["2.97.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-go-chi-chi","fixed_in":["5.3.0-1"],"sources":["osv"]},{"ecosystem":"Go","package":"github.com/go-chi/chi/v5","fixed_in":["5.3.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/go-chi/chi/middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.5.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-chi/chi/v2/middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-chi/chi/v3/middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.3.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-chi/chi/v4/middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-chi/chi/v5/middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.97.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.5-23"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.7-1","5.1.0-1","5.2.0-1","5.2.3-1","5.2.5-1","5.3.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.0-1","5.2.3-1","5.2.5-1","5.3.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1"}]}],"versions":["5.2.0-1","5.2.3-1","5.2.5-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/middleware","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.5.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v2/middleware","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.1.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v3/middleware","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"3.3.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v4/middleware","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.1.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v5/middleware","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.3.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-chi/chi/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.3.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.7-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.14-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.7-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.14-oidc-discovery-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.7-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.14-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.7-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.2-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.2-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15-oidc-discovery-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.2-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.2-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.1-2","5.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-go-chi-chi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.0-1","5.2.3-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"v2ray-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53.0-bp160.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cloudflared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.8.2-bp160.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-bp160.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"warewulf4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-bp160.1.1"}]}],"bundled":4}],"products":[{"vendor":"go-chi","product":"chi"}],"references":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp","tags":["vendor-advisory","exploit","advisory","web","article","report"]},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-before-ip-spoofing-via-realip-middleware","tags":["third-party-advisory","advisory","article","report"]},{"url":"https://github.com/go-chi/chi/releases/tag/v5.3.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rjr7-jggh-pgcp"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72816","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xg24-pmhh-m4m9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72816.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-72816","tags":["advisory"]},{"url":"https://github.com/go-chi/chi","tags":["package"]},{"url":"https://github.com/go-chi/chi/pull/967","tags":["fix"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49718","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-72816","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-72817","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-72815","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49718.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515988","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72815","tags":["advisory"]},{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-ip-spoofing-via-x-forwarded-for-header","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515985","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72816","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2516008","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72817","tags":["advisory"]},{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-before-ip-spoofing-via-x-forwarded-for","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49732","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49732.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54420","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54420.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-72816","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276128","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72817","tags":["web"]},{"url":"https://bugzilla.suse.com/1258546","tags":["report"]},{"url":"https://bugzilla.suse.com/1266787","tags":["report"]},{"url":"https://bugzilla.suse.com/1276119","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://bugzilla.suse.com/1276196","tags":["report"]},{"url":"https://bugzilla.suse.com/1265425","tags":["report"]},{"url":"https://bugzilla.suse.com/1276124","tags":["report"]},{"url":"https://bugzilla.suse.com/1276651","tags":["report"]},{"url":"https://bugzilla.suse.com/1277965","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://bugzilla.suse.com/1262805","tags":["report"]},{"url":"https://bugzilla.suse.com/1276100","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-72816","title":"go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware","description":"go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.","status":"published","published":"2026-08-14T11:35:28.145Z","modified":"2026-10-08T15:24:31.66Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:19:51.663093Z"}],"euvd":[{"id":"EUVD-2026-58631","description":"go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.","status":"published","published":"2026-08-14T11:35:28Z","modified":"2026-10-08T15:24:31Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:31.218078Z"}],"ghsa":[{"id":"GHSA-rjr7-jggh-pgcp","title":"chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header","description":"### Summary\nrealip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass rate limits or access controls\n\n### Details\n\nthe vuln is in middleware/realip.go , the realIP() function pulls IPs straight from client headers and replaces r.RemoteAddr without checking if the request came from a trusted proxy\n\n```go\nfunc realIP(r *http.Request) string {\n    var ip string\n    if tcip := r.Header.Get(trueClientIP); tcip != \"\" {\n        ip = tcip  // controlled by attacker\n    } else if xrip := r.Header.Get(xRealIP); xrip != \"\" {\n        ip = xrip  // controlled by attacker\n    } else if xff := r.Header.Get(xForwardedFor); xff != \"\" {\n        ip, _, _ = strings.Cut(xff, \",\")  // controlled by attacker\n    }\n    // ...\n    return ip\n}\n```\n\nno trusted proxy cidr check in place, any client can send these headers\n\n### PoC\n\ncreate a server with chi and use realip middleware\n\n```go\npackage main\n\nimport (\n    \"fmt\"\n    \"net/http\"\n    \"github.com/go-chi/chi/v5\"\n    \"github.com/go-chi/chi/v5/middleware\"\n)\n\nfunc main() {\n    r := chi.NewRouter()\n    r.Use(middleware.RealIP)\n\n    r.Get(\"/admin\", func(w http.ResponseWriter, r *http.Request) {\n        // ip-based access control got bypassed\n        if r.RemoteAddr == \"127.0.0.1\" {\n            w.Write([]byte(\"SECRET ADMIN DATA\"))\n            return\n        }\n        http.Error(w, \"Forbidden\", 403)\n    })\n\n    http.ListenAndServe(\":8080\", r)\n}\n```\n\nspoofed the ip to bypass access control\n\n```bash\ncurl -H \"X-Forwarded-For: 127.0.0.1\" http://localhost:8080/admin\n```\n\n\n### Impact\n\n- ip-based access control bypass lets attackers reach restricted endpoints\n- rate limiting bypass lets attackers avoid limits by rotating spoofed ips\n- audit logs show fake ips picked by attacker instead of real ones\n- attackers can get around geo ip restrictions\n\n## Remediation Recommendation\n\nvalidate proxy cidr first before trusting forwarded ip headers\n\n```go\n// add your reverse proxy ip addresses here\nvar trustedProxies = []net.IPNet{\n       {IP: net.ParseIP(\"10.0.0.0\"), Mask: net.CIDRMask(8, 32)},\n    {IP: net.ParseIP(\"172.16.0.0\"), Mask: net.CIDRMask(12, 32)},\n    {IP: net.ParseIP(\"192.168.0.0\"), Mask: net.CIDRMask(16, 32)},\n}\n\nfunc isTrustedProxy(ip net.IP) bool {\n    for _, cidr := range trustedProxies {\n        if cidr.Contains(ip) {\n            return true\n        }\n    }\n    return false\n}\n```","status":"published","published":"2026-06-25T18:19:15Z","modified":"2026-06-25T18:19:17Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-290","CWE-348"],"updated_at":"2026-11-02T14:40:33.778544Z"},{"id":"GHSA-xg24-pmhh-m4m9","title":"go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware ...","description":"go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.","status":"published","published":"2026-08-14T12:31:25Z","modified":"2026-08-14T12:31:34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:10:28.576497Z"}],"nvd":[{"id":"CVE-2026-72816","description":"go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.","status":"published","published":"2026-08-14T12:16:44.62Z","modified":"2026-10-08T16:17:35.783Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"CVE-2026-72816","title":"go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware","description":"go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.","status":"published","published":"2026-08-14T11:35:28.145Z","modified":"2026-10-28T02:30:49.292032754Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:45:15.88521Z"},{"id":"DEBIAN-CVE-2026-72816","description":"go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.","status":"published","published":"2026-08-14T12:16:44.62Z","modified":"2026-10-09T09:47:24.682938388Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"GHSA-rjr7-jggh-pgcp","title":"chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header","description":"### Summary\nrealip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass rate limits or access controls\n\n### Details\n\nthe vuln is in middleware/realip.go , the realIP() function pulls IPs straight from client headers and replaces r.RemoteAddr without checking if the request came from a trusted proxy\n\n```go\nfunc realIP(r *http.Request) string {\n    var ip string\n    if tcip := r.Header.Get(trueClientIP); tcip != \"\" {\n        ip = tcip  // controlled by attacker\n    } else if xrip := r.Header.Get(xRealIP); xrip != \"\" {\n        ip = xrip  // controlled by attacker\n    } else if xff := r.Header.Get(xForwardedFor); xff != \"\" {\n        ip, _, _ = strings.Cut(xff, \",\")  // controlled by attacker\n    }\n    // ...\n    return ip\n}\n```\n\nno trusted proxy cidr check in place, any client can send these headers\n\n### PoC\n\ncreate a server with chi and use realip middleware\n\n```go\npackage main\n\nimport (\n    \"fmt\"\n    \"net/http\"\n    \"github.com/go-chi/chi/v5\"\n    \"github.com/go-chi/chi/v5/middleware\"\n)\n\nfunc main() {\n    r := chi.NewRouter()\n    r.Use(middleware.RealIP)\n\n    r.Get(\"/admin\", func(w http.ResponseWriter, r *http.Request) {\n        // ip-based access control got bypassed\n        if r.RemoteAddr == \"127.0.0.1\" {\n            w.Write([]byte(\"SECRET ADMIN DATA\"))\n            return\n        }\n        http.Error(w, \"Forbidden\", 403)\n    })\n\n    http.ListenAndServe(\":8080\", r)\n}\n```\n\nspoofed the ip to bypass access control\n\n```bash\ncurl -H \"X-Forwarded-For: 127.0.0.1\" http://localhost:8080/admin\n```\n\n\n### Impact\n\n- ip-based access control bypass lets attackers reach restricted endpoints\n- rate limiting bypass lets attackers avoid limits by rotating spoofed ips\n- audit logs show fake ips picked by attacker instead of real ones\n- attackers can get around geo ip restrictions\n\n## Remediation Recommendation\n\nvalidate proxy cidr first before trusting forwarded ip headers\n\n```go\n// add your reverse proxy ip addresses here\nvar trustedProxies = []net.IPNet{\n       {IP: net.ParseIP(\"10.0.0.0\"), Mask: net.CIDRMask(8, 32)},\n    {IP: net.ParseIP(\"172.16.0.0\"), Mask: net.CIDRMask(12, 32)},\n    {IP: net.ParseIP(\"192.168.0.0\"), Mask: net.CIDRMask(16, 32)},\n}\n\nfunc isTrustedProxy(ip net.IP) bool {\n    for _, cidr := range trustedProxies {\n        if cidr.Contains(ip) {\n            return true\n        }\n    }\n    return false\n}\n```","status":"published","published":"2026-06-25T18:19:15Z","modified":"2026-09-10T03:50:50.38933619Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-290","CWE-348"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"RHSA-2026:49718","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-20T10:18:32Z","modified":"2026-10-06T10:31:28.680151407Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49732","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-20T10:18:33Z","modified":"2026-10-06T10:31:28.629076537Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:54420","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-20T10:19:23Z","modified":"2026-09-26T10:09:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-72816","description":"go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.","status":"published","published":"2026-08-14T12:16:00Z","modified":"2026-08-19T11:11:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"AZL-96635","title":"CVE-2026-72816 affecting package gh for versions less than 2.97.0-1","description":"go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.","status":"published","published":"2026-08-14T12:16:44Z","modified":"2026-09-09T06:55:05Z","updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"AZL-96689","title":"CVE-2026-72816 affecting package influxdb 2.7.5-23","description":"go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.","status":"published","published":"2026-08-14T12:16:44Z","modified":"2026-11-05T14:17:23.383114182Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"GO-2026-5777","title":"Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi","description":"Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi","status":"published","published":"2026-07-24T18:35:55Z","modified":"2026-08-15T05:19:15.7565796Z","updated_at":"2026-11-02T15:47:02.838915Z"},{"id":"openSUSE-SU-2026:21645-1","title":"Security update for trivy","description":"This update for trivy fixes the following issue:\n\n- CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing vulnerabilities allow\n  authentication bypass, authorization override, and log forgery (bsc#1276128).\n\nChanges for trivy:\n\n- Update to version 0.74.0:\n * release: v0.74.0 [main] (#11037)\n * chore(deps): update golang.org/x modules (#11094)\n * chore(deps): bump the docker group with 2 updates (#11090)\n * docs: update release branch ruleset instructions (#11093)\n * chore(deps): bump the common group across 1 directory with 7 updates (#11086)\n * fix(misconf): unmark cty values outside the evaluation context (#11078)\n * chore(deps): bump the aws group across 1 directory with 6 updates (#11053)\n * fix(misconf): parse Azure flexible server parameters under their own names (#11072)\n * chore(deps): bump the docker group with 2 updates (#11054)\n * feat: add RapidFort curated image scanner (#10452)\n * feat(java): resolve JAR license URLs to SPDX IDs (Bundle-License, pom \u003curl\u003e) (#10948)\n * refactor(misconf): remove unused Azure expression-related code (#10637)\n * fix(server): preserve check aliases and query in uploaded blobs (#11080)\n * fix(java): read artifact properties only from the MANIFEST.MF main section (#11066)\n * fix(terraform): support OpenTofu language block (#10923)\n * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#11063)\n * ci: trigger Auto Ready for Review after Test docs (#11045)\n * docs: remove trivy-checks from AWS ECR locations (#11044)\n * refactor(ubuntu): move EOL version resolution out of loop (#11047)\n * fix(python): normalize dependency names in PEP 621 pyproject.toml (#11050)\n * chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#11042)\n * chore(deps): bump github.com/nikolalohinski/gonja/v2 to v2.9.0 (#11038)\n * fix(terraform): avoid panic when for_each local has unknown object values (#11019)\n * chore(deps): bump the github-actions group across 2 directories with 15 updates (#11028)\n * ci(spdx): migrate to Slack notifications (#11032)\n * ci(helm): bump Trivy version to 0.73.0 for Trivy Helm Chart 0.25.0 (#11034)\n- Update to version 0.73.0:\n * release: v0.73.0 [main] (#11012)\n * docs: clarify debug logs when version check or telemetry is disabled (#10984)\n * feat(java): support user-defined Maven mirrors in trivy.yaml (#11006)\n * chore(deps): bump the common group across 1 directory with 17 updates (#11025)\n * chore(deps): bump the docker group across 1 directory with 2 updates (#10991)\n * chore(deps): bump the aws group across 1 directory with 6 updates (#10947)\n * refactor(alpine): remove type assertion when reading the APKINDEX archive (#11013)\n * chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#10995)\n * feat(vex): discover OpenVEX in generic in-toto OCI referrers (#10986)\n * refactor(vuln): add OS.Supplier field and unify supplier terminology (#11007)\n * chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.30.0 (#11009)\n * fix(vex): reject non-local VEX repository names (#10987)\n * fix(vex): handle 304 status code (#10307)\n * fix(vuln): don't skip packages covered by a driver's own advisory feed (#10980)\n * fix(conda): avoid panic on an all-operator dependency line (#10955)\n * chore: add schema id (#10969)\n * feat(vex): native discovery of VEX documents stored as OCI artifacts (#10932)\n * feat: add bounded read helpers (#10974)\n * fix(dotnet): identify deps.json root project from dependency graph (#10954)\n * feat(java): read Jenkins plugin manifest licenses (#10939)\n * docs: ask contributors to coordinate before starting on an issue (#10940)\n * fix(nodejs): support pnpm workspaces with overlapping packages (#10894)\n * ci: create release branch with the App token to bypass the merge queue rule (#10931)\n * chore(deps): bump the common group across 1 directory with 15 updates (#10892)\n * feat(seal): detect no-prefix packages by version suffix (#10911)\n * chore(deps): bump the testcontainers group with 2 updates (#10918)\n * chore(deps): bump the docker group across 1 directory with 4 updates (#10919)\n * fix(java): set per-file digest for nested JARs (#10855)\n * fix(misconf): guard nil Healthcheck when building Dockerfile from history (#10899)\n * ci(helm): bump Trivy version to 0.72.0 for Trivy Helm Chart 0.24.0 (#10908)\n * ci(helm): allow trivy team to approve Chart.yaml bumps (#10912)\n","status":"published","published":"2026-08-25T07:22:37Z","modified":"2026-08-27T18:23:13.685422441Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21653-1","title":"Security update for v2ray-core","description":"This update for v2ray-core fixes the following issues:\n\nChanges in v2ray-core:\n\n- Update version to 5.53.0\n  * Add X-Forwarded-For support to gRPC transport\n  * Add Stream based Packet Addr for UDP Connections\n  * rrpit: compact session, async send, session recovery\n  * Add socks5ify engineering command\n  * Fix bugs\n  * Update modules (boo#1276119 and CVE-2026-72817, CVE-2026-72815, CVE-2026-72816)\n\n- Update version to 5.51.2\n  * Wireguard Add TCP Listener support for wireguard outbound\n  * Stun Nat Type Testing\n  * Better server failure detection and PreserveSourceIPPortWhenDestNATMapping\n    detection\n  * Improve API instance support\n  * feat: grpc: allow configurable keepalive and initial windows size\n  * Add RRPIT - Rapid Reliable Packet Interactive Transport\n  * Add WebRTC Tunnel Support in V2Ray(unreleased)\n  * also parse X-Forwarded-For in httpupgrade\n  * gdocsviewer: Add Google Docs Viewer based transport\n  * gdocsviewer: Refine poll logic and allow custom headers to reduce rate limiting\n  * gdocsviewer: allow adding headers in public config\n  * Fix bugs (boo#1258546 and CVE-2026-27017)\n\n- update golang.org/x/net to 0.55.0 to fix boo#1266787 and CVE-2026-39821\n","status":"published","published":"2026-08-25T18:20:49Z","modified":"2026-08-27T18:23:13.786991834Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21670-1","title":"Security update for cloudflared","description":"This update for cloudflared fixes the following issues:\n\nChanges in cloudflared:\n\n- Update version to 2026.8.2\n  * Update vendor archive to fix github.com/go-chi/chi/v5 (boo#1276196, CVE-2026-72815, CVE-2026-72816, CVE-2026-72817)\n  * Add OpenRC support\n  * Migrate config renovate.json\n  * Fix bugs\n","status":"published","published":"2026-08-27T19:43:09Z","modified":"2026-08-28T17:30:03.725155406Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21793-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update to 2.1.0 (bsc#1265425, CVE-2026-41888):\n  * `v2.1.0` is a **minor** release built on the containerd-\n    native foundation laid down in `v2.0.0`. The headline is that\n    `hauler store sync` and `hauler store add` are now fully\n    concurrent, with signature verification pinned to digests and\n    running in parallel too. Alongside that, this release adds an\n    audit trail, a store integrity checker, store-to-manifest\n    generation, private/insecure registry support across every\n    pull path, and a set of fixes for containerd imports, chunked\n    hauls, and Docker Hub reference handling.\n  * **Notable dependency bumps:** Go → **1.26.6**;\n    `containerd/v2` → 2.3.4; `sigstore/cosign/v3` → 3.1.3;\n    `sigstore/sigstore` → 1.10.9; `go-containerregistry` →\n    0.22.0; `helm/v4` → 4.2.4; `k8s.io` libs (apimachinery, api,\n    client-go) → 0.37.0; `logrus` → 1.10.2; `docker/go-metrics` →\n    0.1.0; `sigstore/rekor` → 1.5.4 (CVE resolution); plus\n    `x/mod` and `go-isatty`.\n\n- update to 2.0.3 (bsc#1276124,\n  CVE-2026-72817,CVE-2026-72815,CVE-2026-72816):\n  * Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport\n    #688)\n  * Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the\n    go_modules group across 1 directory (backport #691)\n  * fix for homebrew macOS binary quarantine (backport #690)\n  * fix: process Helm deps before --add-images discovery\n    (backport #703)\n  * update hauler store remove to handle registry reference as\n    part of string (backport #705)\n  * fixed vuln for golang grpc\n","status":"published","published":"2026-09-03T12:32:31Z","modified":"2026-09-09T18:23:15.8738835Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21918-1","title":"Security update for warewulf4","description":"This update for warewulf4 fixes the following issues:\n\nChanges in warewulf4:\n\n- updating to v4.7.1 with the following changes\n  * wwctl power no longer falls back to the local BMC for nodes with no\n    ipmi: ipaddr:, which could power off the Warewulf server itself\n  * wwclient is built with GOAMD64=v1 and no longer fails with an illegal\n    instruction on older nodes\n  * prevent image and overlay corruption from 64-bit inode numbers\n    truncating in cpio\n  * fix kernel version detection for releases with a version-like suffix\n    after the dist tag\n  * several fixes for IPv6-only servers and nodes: dracut boot,\n    wwctl node status, dnsmasq, NetworkManager\n  * remove dsa from the default ssh: key types, which could leave nodes\n    with no usable host keys on EL9\n  * mount non-root filesystems before image extraction during\n    provision-to-disk\n  * overlay template fixes for parent directories and symbolic links\n- dependency updates, including go-jose 4.1.4 for CVE-2026-34986 (bsc#1262805)\n- updated go-chi to v5.3.2 to fix CVE-2026-72815, CVE-2026-72816 and\n  CVE-2026-72817 (IP spoofing: authentication bypass, authorization\n  override, and log forgery) (bsc#1276100)\n","status":"published","published":"2026-09-18T10:51:38Z","modified":"2026-09-25T18:23:13.334775304Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}