Executive brief
Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi
Affected products
- Go github.com/go-chi/chi/v5
Junglewise Threat Intelligence
CVE-2025-71405: GO-2025-3770 - Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi
CVE-2025-71405 · Severity: medium · CVSS 4 · Published 2025-07-21
Technologies: github.com/go-chi/chi/v5 (Go). Vendors: Go.
Related threats
- GO-2026-5777 - Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi
- GO-2026-5774 - Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi
- GO-2026-5775 - Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi
- Duplicate Advisory: chi has an open redirect vulnerability in the RedirectSlashes middleware
- go-chi chi open redirect in RedirectSlashes middleware