CVE-2026-72815

The Go HTTP router library go-chi (chi) versions 5.2.1 through versions before 5.3.0 ship a RealIP middleware that blindly trusts the first (leftmost) entry of the client-supplied X-Forwarded-For header when determining the client IP address. A remote attacker sends a request with an attacker-chosen X-Forwarded-For value, causing the application to treat the connection as coming from a different IP than the real one. This lets the attacker bypass IP-based access control lists and per-IP rate limiting, and forge log entries that can hide malicious activity. Only Go applications built with chi 5.2.1-5.2.x that enable the RealIP middleware (typically those deployed behind a reverse proxy or load balancer) are affected. Exploitation has not been confirmed in the wild: a public proof-of-concept exists, and EPSS estimates only about a 0.4% probability of exploitation in the next 30 days.

What to do: Upgrade chi to v5.3.0 or later. As a workaround, ensure your edge reverse proxy or load balancer overwrites (rather than appends to) the X-Forwarded-For header with the true client IP before requests reach the application. Audit any IP-based allowlists, denylists, and rate-limit rules, and review recent access logs for requests carrying forged X-Forwarded-For values.