Medium severity6.5NVD Advisory· Published Aug 14, 2026· Updated Sep 9, 2026
CVE-2026-72817
CVE-2026-72817
Description
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9- osv-coords8 versionspkg:rpm/opensuse/v2ray-core&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/trivy&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/cloudflared&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/trivy&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/v2ray-core&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/hauler&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/warewulf4&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/hauler&distro=openSUSE%20Tumbleweed
< 5.53.0-1.1+ 7 more
- (no CPE)range: < 5.53.0-1.1
- (no CPE)range: < 0.74.0-1.1
- (no CPE)range: < 2026.8.2-bp160.1.1
- (no CPE)range: < 0.74.0-160000.1.1
- (no CPE)range: < 5.53.0-bp160.1.1
- (no CPE)range: < 2.1.0-bp160.1.1
- (no CPE)range: < 4.7.1-1.1
- (no CPE)range: < 2.0.3-1.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.