Open Redirect in Go-Chi Framework

Executive Summary

CVE-2025-71405 is an open redirect vulnerability in the RedirectSlashes middleware of the Go-Chi/Chi framework versions before v5.2.2. It occurs because the middleware uses the Host header to build redirect URLs, allowing attackers to manipulate this header to redirect users to arbitrary domains.

Useful 0 Not Useful 0

Detection Guidance

Check if your Go-Chi/Chi framework version is below v5.2.2 by running: go list -m github.com/go-chi/chi. Inspect middleware configuration for RedirectSlashes usage in your application code. Monitor HTTP response headers for unexpected redirects or unusual Host header values.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited for phishing attacks, credential theft, or malware distribution by tricking users into visiting malicious sites. Attackers manipulate the Host header to redirect users to attacker-controlled domains.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the Go-Chi/Chi framework to version v5.2.2 or later. Replace r.Host with r.RequestURI in redirect logic. If host header usage is required, implement strict validation for allowed hosts. Review and update middleware configurations to remove vulnerable RedirectSlashes usage.

Useful 0 Not Useful 0