Bug 2516008 (CVE-2026-72817)

Summary: CVE-2026-72817 github.com/go-chi/chi/middleware: go-chi/chi: IP spoofing via X-Forwarded-For header manipulation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, abuckta, akoudelk, anthomas, aprice, aruklets, cmah, crizzo, dfreiber, dhanak, dkuc, doconnor, drosa, drow, dsimansk, eaguilar, ebaron, eborisov, ehelms, eshamard, ggainey, gparvin, gtanzill, jburrell, jbuscemi, jcantril, jdobes, jmatsuok, jmitchel, jpasqual, jsamir, jsherril, jtolenti, juwatts, jvasik, kaycoth, kgaikwad, kingland, kshier, lball, lbragsta, mdellweg, mhulan, mnovotny, mstipich, mwringe, ngough, nmoumoul, oezr, orabin, osousa, pcreech, pjindal, rblanco, rchan, rexwhite, rhaigner, rhel-process-autobot, rjohnson, rochandr, rojacob, sausingh, sdawley, smallamp, stcannon, sthirugn, teagle, tmalecek, veshanka, vkumar, watson-tool-maintainers, wenshen, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the `go-chi/chi` component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the `X-Forwarded-For` header. A remote attacker can exploit this by prepending a forged IP address to the `X-Forwarded-For` header, leading to IP spoofing. This could allow the attacker to bypass access controls or falsify request logs.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2518171, 2518173, 2518174, 2518175, 2518176, 2518177, 2518178, 2518184, 2518187, 2518189, 2518190, 2518192, 2518196, 2518197, 2518198, 2518199, 2518200, 2518201, 2518202, 2518203, 2518180, 2518181, 2518195, 2518204    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-14 12:02:45 UTC 
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.