CVE-2026-72816 go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware
Attackers can spoof IP addresses via headers in chi's RealIP middleware to bypass access controls and rate limits if trusted proxies are not configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72816?
CVE-2026-72816 is a medium-severity vulnerability in go-chi chi, published on 14 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.
Weakness: CWE-290
Which versions are affected by CVE-2026-72816?
11 open source packages ship an affected version, including github.com/go-chi/chi/middleware, github.com/go-chi/chi/v2/middleware and github.com/go-chi/chi/v3/middleware.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-chi/chi/middleware Go | All versions to 1.5.5 | None |
github.com/go-chi/chi/middleware Go | All versions to 1.5.5 | None |
github.com/go-chi/chi/v2/middleware Go | All versions to 2.1.1 | None |
github.com/go-chi/chi/v2/middleware Go | All versions to 2.1.1 | None |
github.com/go-chi/chi/v3/middleware Go | All versions to 3.3.5 | None |
github.com/go-chi/chi/v3/middleware Go | All versions to 3.3.5 | None |
5 more packages
github.com/go-chi/chi/v4/middleware Go | All versions to 4.1.3 | None |
github.com/go-chi/chi/v4/middleware Go | All versions to 4.1.3 | None |
github.com/go-chi/chi/v5 Go | All versions | 5.3.0 |
github.com/go-chi/chi/v5/middleware Go | All versions | 5.3.0 |
github.com/go-chi/chi/v5/middleware Go | All versions | 5.3.0 |
How do I fix CVE-2026-72816?
Upgrade to a fixed version.
Is CVE-2026-72816 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72816 exists.
Sources
Also known as AZL-96635, AZL-96689, CLEANSTART-2026-LL29921, CLEANSTART-2026-RS34539, CLEANSTART-2026-UC45945, DEBIAN-CVE-2026-72816 and 115 more.