CVE-2026-72816 go-chi CVE debrief

Who should care

Defenders responsible for go-chi/chi deployments, particularly those using IP-based access controls, rate limiting, or geo-IP restrictions, should assess exposure and prioritize upgrading to version 5.3.0 or later.

Why it matters

CVE-2026-72816 allows attackers to bypass security controls and pollute audit logs by supplying arbitrary IP addresses in client-controlled headers, impacting defenders who rely on IP-based security measures.

• Bypassing IP-based access controls
• Evading rate limiting and geo-IP restrictions
• Polluting audit logs with arbitrary IP addresses

Technical summary

The RealIP middleware in go-chi/chi versions up to 5.2.1 is vulnerable to IP spoofing. The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. This allows attackers to supply arbitrary IP addresses, bypassing security controls and potentially leading to unauthorized access, evasion of rate limiting, and pollution of audit logs. The vulnerability is addressed in version 5.3.0, which includes fixes to properly validate the source of IP addresses.

Defensive priority

Defenders should prioritize verifying exposure of go-chi/chi versions up to 5.2.1 and upgrading to version 5.3.0 or later.

Recommended defensive actions

• Verify go-chi/chi version and upgrade to 5.3.0 or later if necessary
• Review and update IP-based access controls and rate limiting configurations
• Monitor audit logs for potential IP spoofing attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, confirming its existence in go-chi/chi versions up to 5.2.1. The vendor has released a fixed version 5.3.0. However, the records do not specify which versions beyond 5.2.1 are affected. Defenders should verify exposure and prioritize upgrading to version 5.3.0 or later. The lack of detailed version information beyond 5.2.1 limits the ability to assess full scope but indicates a need for immediate review of deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.