Bug 2515988 (CVE-2026-72815) - CVE-2026-72815 github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls
Summary: CVE-2026-72815 github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via ...
Keywords:
Status: NEW
Alias: CVE-2026-72815
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2518038 2518039 2518040 2518041 2518042 2518043 2518044 2518048 2518049 2518051 2518052 2518053 2518055 2518056 2518037 2518045 2518046 2518047 2518050 2518054 2518057
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-14 11:58 UTC by OSIDB Bzimport
Modified: 2026-08-18 16:42 UTC (History)
73 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-14 11:58:14 UTC 
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.
Note You need to log in before you can comment on or make changes to this bug.