IP Spoofing Vulnerability in go-chi Middleware by Go

CVE-2026-72816

What is CVE-2026-72816?

The go-chi framework version 5.2.1 and earlier is vulnerable due to an IP spoofing flaw in its RealIP middleware. The realIP() function improperly processes client-controlled headers—True-Client-IP, X-Real-IP, and X-Forwarded-For—without verifying if the request originates from a trusted proxy. This allows attackers to inject arbitrary IP addresses, enabling them to bypass IP-based access restrictions, circumvent rate limiting, manipulate geo-IP rules, and distort audit logs. This security issue has been addressed in version 5.3.0.

References