Medium severityNVD Advisory· Published Aug 14, 2026· Updated Sep 24, 2026
CVE-2026-72815
CVE-2026-72815
Description
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7- osv-coords6 versionspkg:rpm/opensuse/cloudflared&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/trivy&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/v2ray-core&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/cloudflared&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/hauler&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/warewulf4&distro=openSUSE%20Tumbleweed
< 2026.8.2-1.1+ 5 more
- (no CPE)range: < 2026.8.2-1.1
- (no CPE)range: < 0.74.0-160000.1.1
- (no CPE)range: < 5.53.0-bp160.1.1
- (no CPE)range: < 2026.8.2-bp160.1.1
- (no CPE)range: < 2.1.0-bp160.1.1
- (no CPE)range: < 4.7.1-1.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.