The vulnerability in the RealIP middleware of go-chi/chi allows any party that can send HTTP requests to the application to supply arbitrary IP addresses in the headers True-Client-IP, X-Real-IP, and X-Forwarded-For. The middleware blindly copies these values into the request’s RemoteAddr field without checking that the request came from a trusted proxy. As a result, attackers can forge remote client addresses, bypass IP‑based access controls, evade rate limiting or geo‑IP restrictions, and contaminate audit logs with false client origins.

All installations of go-chi/chi released through version 5.2.1 are affected. The issue was fixed in version 5.3.0 and later releases.

With a CVSS score of 6.9, this flaw poses a moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via any HTTP request that reaches the RealIP middleware; an attacker can craft requests with malicious header values to trick the application into treating a spoofed IP as the client’s true address. Successful exploitation requires the application to rely on the RemoteAddr value for security decisions, which is common in many deployments. The lack of a trusted‑proxy check allows attackers to override legitimate IP checks with ease.