Description

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-14T12:16:44.620Z",
  "pubdate": "2026-08-14T12:16:44.620Z",
  "executiveSummary": "An IP spoofing vulnerability exists in the RealIP middleware of the go-chi/chi routing package through version 5.2.1. The vulnerability arises from the insecure handling of client-controlled HTTP headers within the realIP() function located at middleware/realip.go.\nThe flaw allows remote attackers to supply arbitrary IP addresses via headers such as True-Client-IP, X-Real-IP, and X-Forwarded-For, which are subsequently used to overwrite the connection's RemoteAddr without validating whether the request originated from a trusted proxy infrastructure.\nThe primary impact of this vulnerability includes the complete bypass of IP-based access control lists (ACLs), evasion of rate limiting mechanisms, circumvention of geo-IP restrictions, and the pollution of application audit and access logs with falsified origin addresses.\nThe affected product is go-chi/chi across all versions up to and including 5.2.1, with the issue being officially resolved in version 5.3.0.\nAttackers require no prior authentication or special privileges to exploit this vulnerability, as the attack vector is exposed via standard HTTP requests sent directly to web applications utilizing the vulnerable middleware component.",
  "technicalDetails": "The vulnerability is localized within the realIP() function implemented in the middleware/realip.go file of the go-chi/chi package. The root cause of the security flaw is the absence of a validation mechanism to verify if incoming HTTP requests originate from a known, trusted proxy or load balancer before extracting and trusting client IP addresses from specific HTTP headers.\nWhen a request passes through the RealIP middleware, the function inspects headers including True-Client-IP, X-Real-IP, and X-Forwarded-For. Regardless of the connection's true network origin or the absence of a trusted intermediate proxy, the middleware extracts the IP address provided in these headers and directly overwrites the RemoteAddr field of the underlying http.Request object.\nThe step-by-step attack flow begins when an unauthenticated remote attacker crafts an HTTP request directed at an application utilizing the vulnerable go-chi/chi RealIP middleware. The attacker inserts a malicious, arbitrarily chosen IP address into one of the accepted client-identifying headers, such as X-Forwarded-For: 1.2.3.4 or X-Real-IP: 8.8.8.8.\nUpon receiving the request, the realIP() function parses the user-supplied header value without performing any sanity checks or verifying the network socket source against an allowlist of trusted proxies. The middleware then overwrites the r.RemoteAddr property with the attacker-controlled value.\nSubsequent handlers and application logic downstream rely on r.RemoteAddr to enforce security policies, authentication checks, rate limits, and access controls. Because this address has been successfully spoofed, the application treats the request as originating from the forged IP address rather than the attacker's actual network endpoint.\nThis behavior enables post-exploitation impacts such as bypassing security boundaries designed to restrict access based on geographic location or internal network ranges, exhausting service resources by evading rate-limiting algorithms, and corrupting forensic investigations and compliance audits due to inaccurate source IP logging across affected systems."
}