Description
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-chi | chi | 0.9.0 – < 5.3.0 | 5.3.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-go-chi-chi | 5.3.0-1 | — |
| Debian 13 | golang-github-go-chi-chi | No fix yet | — |
| Debian 12 | golang-github-go-chi-chi | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | golang-github-go-chi-chi | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-go-chi-chi | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-go-chi-chi | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | cosign | 3.1.3-0.1.hum1 | RHSA-2026:54420 |
| Red Hat Hardened Images 1 | spire1.14 +3 | 1.14.7-0.4.hum1 | RHSA-2026:49718 |
| Red Hat Hardened Images 1 | spire1.15 +3 | 1.15.2-0.4.hum1 | RHSA-2026:49732 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | hauler | 2.0.3-1.1 | openSUSE-SU-2026:11574-1 |
| openSUSE Tumbleweed | trivy | 0.74.0-1.1 | openSUSE-SU-2026:11578-1 |
| openSUSE Tumbleweed | v2ray-core | 5.53.0-1.1 | openSUSE-SU-2026:11591-1 |
| openSUSE Tumbleweed | warewulf4 | 4.7.1-1.1 | openSUSE-SU-2026:11810-1 |
| openSUSE Leap 16.0 | cloudflared | 2026.8.2-bp160.1.1 | openSUSE-SU-2026:21670-1 |
| openSUSE Leap 16.0 | hauler | 2.1.0-bp160.1.1 | openSUSE-SU-2026:21793-1 |
| openSUSE Leap 16.0 | trivy | 0.74.0-160000.1.1 | openSUSE-SU-2026:21645-1 |
| openSUSE Leap 16.0 | v2ray-core | 5.53.0-bp160.1.1 | openSUSE-SU-2026:21653-1 |
| openSUSE Leap 16.0 | warewulf4 | 4.7.1-bp160.1.1 | openSUSE-SU-2026:21918-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | influxdb | 2.7.5-21 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/go-chi/chi/middleware | >= 0.9.0, <= 1.5.5 | — | GHSA-9g5q-2w5x-hmxf |
| Go | github.com/go-chi/chi/v2/middleware | <= 2.1.1 | — | GHSA-9g5q-2w5x-hmxf |
| Go | github.com/go-chi/chi/v3/middleware | <= 3.3.5 | — | GHSA-9g5q-2w5x-hmxf |
| Go | github.com/go-chi/chi/v4/middleware | <= 4.1.3 | — | GHSA-9g5q-2w5x-hmxf |
| Go | github.com/go-chi/chi/v5 | < 5.3.0 | 5.3.0 | GO-2026-5775 |
| Go | github.com/go-chi/chi/v5/middleware | < 5.3.0 | 5.3.0 | GHSA-9g5q-2w5x-hmxf |
Advisories 12
- RHSA-2026:49718 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:49732 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:54420 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- openSUSE-SU-2026:21918-1 Security update for warewulf4 SUSE / openSUSE Security Updates · Sep 25, 2026
- openSUSE-SU-2026:11810-1 warewulf4-4.7.1-1.1 on GA media SUSE / openSUSE Security Updates · Sep 18, 2026
- openSUSE-SU-2026:21793-1 Security update for hauler SUSE / openSUSE Security Updates · Sep 9, 2026
- openSUSE-SU-2026:21670-1 Security update for cloudflared SUSE / openSUSE Security Updates · Aug 28, 2026
- openSUSE-SU-2026:21645-1 Security update for trivy SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:21653-1 Security update for v2ray-core SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:11591-1 golang-github-v2fly-v2ray-core-5.53.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 26, 2026
- openSUSE-SU-2026:11574-1 hauler-2.0.3-1.1 on GA media SUSE / openSUSE Security Updates · Aug 23, 2026
- openSUSE-SU-2026:11578-1 trivy-0.74.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 23, 2026
References
- GitHub Security Advisory (GHSA-9g5q-2w5x-hmxf) vendor-advisory
- VulnCheck Advisory: go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For third-party-advisory