CVE-2026-72816

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and polluting audit logs.

An IP spoofing flaw exists in go-chi/chi's RealIP middleware (middleware/realip.go). The realIP() function parses untrusted HTTP headers (True-Client-IP, X-Real-IP, X-Forwarded-For) and overwrites r.RemoteAddr without validating upstream proxy identity. Remote unauthenticated attackers can supply arbitrary IP values in these headers to bypass IP-restricted endpoints, subvert rate-limiting controls, or poison application audit logs, posing a Low impact to confidentiality and integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not use the chi/middleware.RealIP middleware when receiving traffic directly from untrusted networks or unverified proxies. Instead, strip or sanitize client-supplied forwarding headers at an upstream edge proxy or reverse proxy (such as NGINX or HAProxy) before requests reach the application.