go-chi up to 5.5.0 Middleware RedirectSlashes redirect

Summaryinfo

A vulnerability was found in go-chi chi up to 5.5.0 and classified as problematic. The impacted element is the function RedirectSlashes of the component Middleware. Executing a manipulation can lead to redirect. This vulnerability appears as CVE-2026-122132. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in go-chi chi up to 5.5.0. This vulnerability affects the function RedirectSlashes of the component Middleware. The manipulation with an unknown input leads to a redirect vulnerability. The CWE definition for the vulnerability is CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. As an impact it is known to affect integrity. CVE summarizes:

go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.

The advisory is available at github.com. This vulnerability was named CVE-2026-122132 since 11/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 11/04/2026). This vulnerability is assigned to T1204.001 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• go-chi

Name

• chi

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5.0

Website

• Product: https://github.com/go-chi/chi/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion