CVE-2026-72817 in chi
Summary
by MITRE • 08/14/2026
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability under discussion affects the go-chi/chi web framework ecosystem specifically within versions 0.9.0 through 5.2.9 where the RealIP middleware implementation contains a critical security flaw that enables IP spoofing attacks. This issue fundamentally compromises the integrity of source IP address determination within HTTP request processing, creating potential pathways for unauthorized access and malicious activity. The vulnerability exists in how the framework handles the X-Forwarded-For header, which is commonly used in proxy environments to preserve original client IP addresses. When a web application relies on the RealIP middleware to determine the true source of incoming requests, attackers can exploit this weakness by manipulating HTTP headers to present false IP addresses.
The technical flaw manifests in the middleware's lack of validation for trusted proxy sources when processing the X-Forwarded-For header. This header typically contains a comma-separated list of IP addresses representing the sequence of proxies through which a request has traveled, with the original client IP usually appearing as the first entry. The vulnerable implementation simply takes the first IP address from this list without verifying whether the requesting entity is an authorized proxy server. This behavior directly violates security principles that require explicit trust validation before accepting forwarded information, creating a scenario where any attacker can manipulate their perceived origin by prepending malicious IP addresses to the header. The vulnerability maps to CWE-287 Authentication Bypass Through User-Controlled Key and aligns with ATT&CK technique T1071.004 Application Layer Protocol: DNS, as it enables attackers to manipulate network traffic characteristics that should remain trustworthy.
The operational impact of this vulnerability extends beyond simple IP address spoofing to encompass serious security implications for applications relying on client IP-based access controls, rate limiting, and logging mechanisms. Attackers can bypass IP whitelisting restrictions, circumvent geographic access controls, and manipulate audit trails by forging their source addresses. This enables malicious actors to perform actions that would otherwise be blocked based on their actual IP address, potentially leading to unauthorized data access or service abuse. The vulnerability particularly affects applications where the RealIP middleware is used for security decisions such as login rate limiting, API access control, or firewall rules. When combined with other attack vectors, this weakness can facilitate more sophisticated attacks by allowing attackers to appear as legitimate users from trusted IP ranges, making detection and mitigation significantly more challenging.
Organizations using affected versions of go-chi/chi should immediately upgrade to version 5.3.0 or later where the vulnerability has been addressed through proper proxy validation mechanisms. The recommended mitigation strategy involves implementing explicit proxy trust configuration that validates which entities are permitted to provide forwarded IP information, rather than blindly trusting the first value in X-Forwarded-For headers. Security practitioners should also review their application's access control logic to ensure that IP-based restrictions are not the sole security mechanism and consider implementing additional layers of authentication or authorization checks. Network administrators should monitor for suspicious patterns in application logs that might indicate IP spoofing attempts, particularly when multiple requests appear to originate from the same address but exhibit different behavioral characteristics. The fix implemented in newer versions typically involves maintaining a list of trusted proxy IP addresses and only accepting forwarded headers from known good sources, thereby preventing attackers from manipulating the request context through malicious header injection. This vulnerability highlights the critical importance of implementing proper input validation and trust models in web application security architectures, particularly when dealing with proxy-related HTTP headers that are commonly used but can be easily manipulated by attackers.