Description
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-chi | chi | 5.2.1 – < 5.3.0 | 5.3.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-go-chi-chi | 5.3.0-1 | — |
| Debian 13 | golang-github-go-chi-chi | No fix yet | — |
| Debian 12 | golang-github-go-chi-chi | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | golang-github-go-chi-chi | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-go-chi-chi | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-go-chi-chi | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | cosign | 3.1.3-0.1.hum1 | RHSA-2026:54420 |
| Red Hat Hardened Images 1 | prometheus3.13 | 3.13.2-0.2.hum1 | RHSA-2026:50287 |
| Red Hat Hardened Images 1 | spire1.14 +3 | 1.14.7-0.4.hum1 | RHSA-2026:49718 |
| Red Hat Hardened Images 1 | spire1.15 +3 | 1.15.2-0.4.hum1 | RHSA-2026:49732 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cloudflared | 2026.8.2-1.1 | openSUSE-SU-2026:11607-1 |
| openSUSE Tumbleweed | kubectl-retina | 1.3.1-1.1 | openSUSE-SU-2026:12297-1 |
| openSUSE Tumbleweed | warewulf4 | 4.7.1-1.1 | openSUSE-SU-2026:11810-1 |
| openSUSE Leap 16.0 | cloudflared | 2026.8.2-bp160.1.1 | openSUSE-SU-2026:21670-1 |
| openSUSE Leap 16.0 | hauler | 2.1.0-bp160.1.1 | openSUSE-SU-2026:21793-1 |
| openSUSE Leap 16.0 | trivy | 0.74.0-160000.1.1 | openSUSE-SU-2026:21645-1 |
| openSUSE Leap 16.0 | v2ray-core | 5.53.0-bp160.1.1 | openSUSE-SU-2026:21653-1 |
| openSUSE Leap 16.0 | warewulf4 | 4.7.1-bp160.1.1 | openSUSE-SU-2026:21918-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
Saku0512/CVE-2026-72815-poc ★ 0 · Sep 10, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/go-chi/chi/v5 | >= 5.2.1, < 5.3.0 | 5.3.0 | GHSA-3fxj-6jh8-hvhx |
| Go | github.com/go-chi/chi/v5/middleware | >= 5.2.1, < 5.3.0 | 5.3.0 | GHSA-3fxj-6jh8-hvhx |
Advisories 12
- openSUSE-SU-2026:12297-1 kubectl-retina-1.3.1-1.1 on GA media SUSE / openSUSE Security Updates · Oct 28, 2026
- RHSA-2026:50287 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:49718 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:49732 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:54420 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- openSUSE-SU-2026:21918-1 Security update for warewulf4 SUSE / openSUSE Security Updates · Sep 25, 2026
- openSUSE-SU-2026:11810-1 warewulf4-4.7.1-1.1 on GA media SUSE / openSUSE Security Updates · Sep 18, 2026
- openSUSE-SU-2026:21793-1 Security update for hauler SUSE / openSUSE Security Updates · Sep 9, 2026
- openSUSE-SU-2026:21670-1 Security update for cloudflared SUSE / openSUSE Security Updates · Aug 28, 2026
- openSUSE-SU-2026:21645-1 Security update for trivy SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:21653-1 Security update for v2ray-core SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:11607-1 cloudflared-2026.8.2-1.1 on GA media SUSE / openSUSE Security Updates · Aug 27, 2026
References
- GitHub Security Advisory (GHSA-3fxj-6jh8-hvhx) vendor-advisory
- VulnCheck Advisory: go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header third-party-advisory