Junglewise Threat Intelligence
CVE-2026-72816: GO-2026-5777 - Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi
CVE-2026-72816 · Severity: medium · CVSS 4 · Published 2026-07-24
Technologies: github.com/go-chi/chi/middleware (Go), github.com/go-chi/chi/v5/middleware (Go), github.com/go-chi/chi/v5 (Go), github.com/go-chi/chi/v2/middleware (Go), github.com/go-chi/chi/v4/middleware (Go), github.com/go-chi/chi/v3/middleware (Go). Vendors: Go.
Executive brief
Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi
Affected products
- Go github.com/go-chi/chi/middleware
- Go github.com/go-chi/chi/v5/middleware
- Go github.com/go-chi/chi/v5
- Go github.com/go-chi/chi/v2/middleware
- Go github.com/go-chi/chi/v4/middleware
- Go github.com/go-chi/chi/v3/middleware