{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/chi--5.2.1--5.3.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:go-chi:chi:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-72815"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["chi (\u003e= 5.2.1, \u003c 5.3.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Go-Chi"],"content_html":"\u003cp\u003eThe go-chi/chi Go library, specifically the \u003ccode\u003emiddleware.RealIP\u003c/code\u003e component, is vulnerable to an IP spoofing flaw tracked as CVE-2026-72815. The middleware insecurely parses the \u003ccode\u003eX-Forwarded-For\u003c/code\u003e HTTP header, trusting the leftmost value provided by the client to populate \u003ccode\u003ehttp.Request.RemoteAddr\u003c/code\u003e. Because the \u003ccode\u003eX-Forwarded-For\u003c/code\u003e header is user-controllable, an attacker can supply a forged header (e.g., \u003ccode\u003eX-Forwarded-For: 127.0.0.1\u003c/code\u003e) to trick the application into believing the request originates from a trusted source, such as the local loopback or a privileged IP range.\u003c/p\u003e\n\u003cp\u003eThis flaw effectively facilitates the bypass of security controls that rely exclusively on IP-based authentication, authorization, or rate limiting. The issue affects go-chi/chi versions 5.2.1 up to, but not including, 5.3.0. While version 5.3.0 introduces secure alternatives, the vulnerable \u003ccode\u003emiddleware.RealIP\u003c/code\u003e remains for backward compatibility, requiring manual code changes by developers to switch to the new \u003ccode\u003eClientIPFrom*\u003c/code\u003e middleware series.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to bypass IP-based ACLs and rate-limiting policies. This can lead to unauthorized access to administrative endpoints or services restricted to specific IP addresses. Given the ubiquity of go-chi in Go-based web applications, the impact on security services relying on source IP identification is significant.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for development and security engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003ego-chi/chi\u003c/code\u003e to version 5.3.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing middleware implementations to replace \u003ccode\u003emiddleware.RealIP\u003c/code\u003e with the appropriate \u003ccode\u003eClientIPFrom*\u003c/code\u003e variants (e.g., \u003ccode\u003eClientIPFromXFF\u003c/code\u003e) that account for trusted proxy chains.\u003c/li\u003e\n\u003cli\u003eImplement infrastructure-level security to ensure that reverse proxies (e.g., Nginx, Envoy, AWS ALB) correctly strip or overwrite incoming \u003ccode\u003eX-Forwarded-For\u003c/code\u003e headers from untrusted clients before the request reaches the Go application.\u003c/li\u003e\n\u003cli\u003eDe-prioritize IP-based ACLs for critical authentication or authorization flows, favoring robust identity-based authentication mechanisms.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-10T02:08:07Z","date_published":"2026-09-10T02:08:07Z","id":"https://feed.craftedsignal.io/briefs/2026-09-chi-middleware-spoofing/","summary":"The go-chi/chi middleware.RealIP component contains a vulnerability (CVE-2026-72815) that allows attackers to bypass IP-based ACLs and rate limits by forging the X-Forwarded-For header.","title":"IP Spoofing Vulnerability in go-chi/chi middleware.RealIP","url":"https://feed.craftedsignal.io/briefs/2026-09-chi-middleware-spoofing/"}],"language":"en","title":"CraftedSignal Threat Feed - Chi (\u003e= 5.2.1, \u003c 5.3.0)","version":"https://jsonfeed.org/version/1.1"}