Description
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-chi | chi | < 5.3.0 | 5.3.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-go-chi-chi | 5.3.0-1 | — |
| Debian 13 | golang-github-go-chi-chi | No fix yet | — |
| Debian 12 | golang-github-go-chi-chi | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | golang-github-go-chi-chi | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-go-chi-chi | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-go-chi-chi | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | cosign | 3.1.3-0.1.hum1 | RHSA-2026:54420 |
| Red Hat Hardened Images 1 | spire1.14 +3 | 1.14.7-0.4.hum1 | RHSA-2026:49718 |
| Red Hat Hardened Images 1 | spire1.15 +3 | 1.15.2-0.4.hum1 | RHSA-2026:49732 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | cloudflared | 2026.8.2-bp160.1.1 | openSUSE-SU-2026:21670-1 |
| openSUSE Leap 16.0 | hauler | 2.1.0-bp160.1.1 | openSUSE-SU-2026:21793-1 |
| openSUSE Leap 16.0 | trivy | 0.74.0-160000.1.1 | openSUSE-SU-2026:21645-1 |
| openSUSE Leap 16.0 | v2ray-core | 5.53.0-bp160.1.1 | openSUSE-SU-2026:21653-1 |
| openSUSE Leap 16.0 | warewulf4 | 4.7.1-bp160.1.1 | openSUSE-SU-2026:21918-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | gh | 2.97.0-1 | — |
| Azure Linux 3 | influxdb | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/go-chi/chi/middleware | <= 1.5.5 | — | GHSA-rjr7-jggh-pgcp |
| Go | github.com/go-chi/chi/v2/middleware | <= 2.1.1 | — | GHSA-rjr7-jggh-pgcp |
| Go | github.com/go-chi/chi/v3/middleware | <= 3.3.5 | — | GHSA-rjr7-jggh-pgcp |
| Go | github.com/go-chi/chi/v4/middleware | <= 4.1.3 | — | GHSA-rjr7-jggh-pgcp |
| Go | github.com/go-chi/chi/v5 | < 5.3.0 | 5.3.0 | GO-2026-5777 |
| Go | github.com/go-chi/chi/v5/middleware | < 5.3.0 | 5.3.0 | GHSA-rjr7-jggh-pgcp |
Advisories 8
- RHSA-2026:49718 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:49732 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:54420 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- openSUSE-SU-2026:21918-1 Security update for warewulf4 SUSE / openSUSE Security Updates · Sep 25, 2026
- openSUSE-SU-2026:21793-1 Security update for hauler SUSE / openSUSE Security Updates · Sep 9, 2026
- openSUSE-SU-2026:21670-1 Security update for cloudflared SUSE / openSUSE Security Updates · Aug 28, 2026
- openSUSE-SU-2026:21645-1 Security update for trivy SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:21653-1 Security update for v2ray-core SUSE / openSUSE Security Updates · Aug 27, 2026
References
- GitHub Security Advisory (GHSA-rjr7-jggh-pgcp) vendor-advisory
- VulnCheck Advisory: go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware third-party-advisory