CVE-2025-71405

A flaw was found in go-chi/chi. The RedirectSlashes middleware function incorrectly uses the Host header to build redirect URLs. A remote attacker can manipulate the Host header to redirect users to arbitrary malicious websites. This can lead to phishing attacks and credential theft.

Red Hat rates this issue Moderate. The vulnerable Host-based redirect implementation is present in go-chi/chi v5 releases from v5.0.0 through v5.2.1 and is fixed in v5.2.2. Exploitation requires an application to use the RedirectSlashes middleware and an attacker to submit a request with a manipulated Host header; upstream notes that normal browsers and email clients cannot directly manipulate this header. Red Hat products identified with go-chi/chi v1 or v4 are not affected because that implementation does not construct redirects from the Host header.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.