Description

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-14T12:16:44.747Z",
  "pubdate": "2026-08-14T12:16:44.747Z",
  "executiveSummary": "An IP spoofing vulnerability exists in the RealIP middleware of go-chi/chi versions 0.9.0 before 5.3.0.\nThe vulnerability allows a malicious client to falsify the request source IP (Request.RemoteAddr) by supplying an arbitrary IP address as the first value in the X-Forwarded-For HTTP header.\nThis flaw impacts applications utilizing the affected RealIP middleware without proxy validation.\nThe risk implications include the potential bypassing of IP-based access controls, rate limiting circumvention, and the falsification of request audit logs.\nAn attacker can exploit this vulnerability with no prior authentication or special privileges by interacting directly with the exposed web application or through untrusted intermediary networks.\nSuccessful exploitation requires the application to rely on the unvalidated RealIP middleware to determine client IP addresses for security decisions.",
  "technicalDetails": "The vulnerability resides in the RealIP middleware component of the go-chi/chi package, specifically affecting versions 0.9.0 through 5.2.0.\nThe root cause of the vulnerability is the improper implementation of client IP resolution, where the middleware blindly trusts and extracts the first IP address present in the X-Forwarded-For header without validating whether the immediate downstream connection originates from a trusted proxy or load balancer.\nNetwork exposure is inherent to any deployment where the vulnerable go-chi/chi application is accessible over a network and utilizes the RealIP middleware to parse incoming HTTP requests.\nNo authentication or elevated privileges are required to exploit this issue, as the attack vector relies solely on manipulating HTTP header data during standard client-to-server communication.\nThe exploitation method involves the attacker crafting an HTTP request containing a malicious X-Forwarded-For header where the leading value is a forged or spoofed IP address chosen by the adversary.\nThe attack flow proceeds as follows: 1) The malicious client initiates an HTTP request to the vulnerable go-chi/chi application. 2) The attacker prepends an arbitrary forged IP address to the X-Forwarded-For header. 3) The RealIP middleware intercepts the request, parses the X-Forwarded-For header, and extracts the first listed IP address as the definitive source address. 4) The middleware overwrites Request.RemoteAddr with the forged IP address without verifying the authenticity of the proxy chain or checking against a configured list of trusted proxies. 5) Subsequent application logic, security controls, and logging mechanisms process the forged IP as the genuine client origin.\nThe post-exploitation impact includes unauthorized access to restricted endpoints protected by IP whitelists, evasion of rate-limiting mechanisms designed to track client activity, and the pollution of application logs with untrusted, spoofed forensic data."
}