Vulnerability in Go-Chi Chi
CVE-2026-72815
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.
Published · last modified .
EPSS exploit prediction
EPSS: 0.005 (40.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 40.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.001
Affected products
- Go-Chi Chi — versions 5.2.1, 5.3.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx (vendor-advisory)
- www.vulncheck.com/advisories/go-chi-chi-ip-spoofing-via-x-forwarded-for-header (third-party-advisory)
Frequently asked questions
- What is CVE-2026-72815?
- CVE-2026-72815 is a vulnerability in Go-Chi Chi, classified under Authentication Bypass by Spoofing. Published 2026-08-14.
- Is CVE-2026-72815 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.