go-chi chi IP spoofing in RealIP middleware

Executive brief

The RealIP middleware in the chi Go web framework incorrectly trusts IP address information provided in network headers without verification. This allows an attacker to spoof their IP address, potentially bypassing security measures like rate limits, geographic restrictions, or IP-based access controls. Organizations using this middleware for security decisions or audit logging are at risk of unauthorized access and inaccurate forensic data.

Technical details

A vulnerability exists in the RealIP middleware of the go-chi/chi library where the realIP() function extracts IP addresses from headers such as X-Forwarded-For, X-Real-IP, and True-Client-IP without verifying if the request originated from a trusted proxy. By sending a crafted request with these headers, a remote, unauthenticated attacker can overwrite the RemoteAddr field used by the application. This can be exploited to bypass IP-based access control lists (ACLs), circumvent rate limiting, and manipulate audit logs. The issue is resolved in version 5.3.0 by requiring manual validation of proxy CIDRs before trusting forwarded headers.

Affected products

• go-chi chi/middleware < 5.3.0

Timeline

• 2026-05-22: disclosed
• 2026-06-25: advisory
• 2026-06-25: patched: Fixed in v5.3.0

References

• https://api.github.com/users/rezmoss
• https://github.com/rezmoss
• https://api.github.com/users/rezmoss/gists%7B/gist_id%7D
• https://api.github.com/users/rezmoss/repos
• https://avatars.githubusercontent.com/u/178949074?v=4
• https://api.github.com/users/rezmoss/events%7B/privacy%7D