IP Spoofing in go-chi chi Middleware by Altering X-Forwarded-For Header

CVE-2026-72815

What is CVE-2026-72815?

The go-chi chi middleware presents an IP spoofing vulnerability that stems from its handling of the X-Forwarded-For HTTP header. This vulnerability allows an attacker to manipulate the value of the IP addresses sent in requests. By exploiting this flaw, attackers can bypass essential security measures such as IP-based access control lists and rate-limiting systems, potentially leading to unauthorized access and the ability to forge log entries. The vulnerability exists in versions 5.2.1 to 5.2.9 and is addressed in version 5.3.0.

References