This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-72815 →

DEBIAN-CVE-2026-72815

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost)...

Original description

The description as published by the source.

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 golang-github-go-chi-chi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 golang-github-go-chi-chi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 golang-github-go-chi-chi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1"}]}]

References

advisory security-tracker.debian.org