The vulnerability resides in the RedirectSlashes middleware of the Go-chi library. Prior to version 5.2.2, the middleware builds redirect URLs using the Host header supplied in incoming HTTP requests. An attacker can supply a forged Host header containing an arbitrary URL, causing the server to redirect users to that URL. This allows phishing attacks and illicit credential harvesting.

Affected products are all releases of the go-chi:chi library older than v5.2.2. Any application that incorporates the RedirectSlashes middleware in those versions is susceptible.

The CVSS score of 5.1 indicates a moderate severity, and the EPSS score is currently unavailable, meaning the exact exploitation probability is uncertain. Because the vulnerability relies on the Host header, it can be triggered by an external attacker sending a manipulated request to a target service that uses the middleware. Although it is not listed in CISA’s KEV catalog, the ability to redirect users to malicious sites could facilitate credential compromise.