The vulnerability in the RealIP middleware of go-chi/chi allows any party that can send HTTP requests to the application to supply arbitrary IP addresses in the headers True-Client-IP, X-Real-IP, and X-Forwarded-For. The middleware blindly copies these values into the request’s RemoteAddr field without checking that the request came from a trusted proxy. As a result, attackers can forge remote client addresses, bypass IP‑based access controls, evade rate limiting or geo‑IP restrictions, and contaminate audit logs with false client origins.

All installations of go-chi/chi released through version 5.2.1 are affected. The issue was fixed in version 5.3.0 and later releases.

With a CVSS score of 6.9, this flaw poses a moderate risk. The EPSS score is 0.00219 (<1%) and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via any HTTP request that reaches the RealIP middleware; an attacker can craft requests with malicious header values to trick the application into treating a spoofed IP as the client’s true address. Successful exploitation requires the application to rely on the RemoteAddr value for security decisions, which is common in many deployments. The lack of a trusted‑proxy check allows attackers to override legitimate IP checks with ease.