CVE-2026-72815
Received Received - Intake

IP Spoofing in go-chi RealIP Middleware

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72815
EUVD
EUVD-2026-58630

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-chi chi From 5.2.1 (inc) to 5.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an IP spoofing issue in the go-chi chi framework versions 5.2.1 and below 5.3.0. The RealIP middleware blindly trusts the first IP address in the X-Forwarded-For HTTP header, allowing attackers to bypass IP-based access controls and rate-limiting by injecting a spoofed IP address.

Detection Guidance

To detect this vulnerability, inspect HTTP requests for the X-Forwarded-For header in your go-chi chi application. Check if the middleware.RealIP component is used and if it blindly trusts the leftmost IP. Use network monitoring tools to analyze header manipulation attempts.

Impact Analysis

An attacker could bypass IP-based access restrictions, evade rate limits, and forge log entries by manipulating the X-Forwarded-For header. This could lead to unauthorized access to protected resources or services.

Compliance Impact

This vulnerability could compromise data integrity by allowing forged log entries, potentially violating audit and logging requirements in GDPR and HIPAA. Unauthorized access may also lead to data breaches, impacting compliance.

Mitigation Strategies

Upgrade go-chi chi to version 5.3.0 or later. If upgrading is not possible, disable the RealIP middleware or configure it to verify proxy chains by traversing the X-Forwarded-For header from right to left and stopping at the first untrusted proxy IP.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72815. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart