The Weakness in the RealIP middleware is identified as a CWE-345 and CWE-501 flaw. It processes the first IP address listed in the X-Forwarded-For header as the client’s source IP without validating that the header originates from a trusted proxy. An attacker can prepend a forged IP address as the first value, making the system believe the request came from that address. This enables IP spoofing, which can be used to bypass IP‑based access restrictions, impersonate another client, or falsify logs that rely on the remote address.

The vulnerable product is the go‑chi routing library, known as chi, in versions 0.9.0 up to but not including 5.3.0. Any installation that employs the RealIP middleware to resolve upstream client addresses is affected.

Based on the CVSS score of 6.9, the vulnerability falls into the moderate range of severity. The EPSS score of <1% indicates a very low probability of exploitation in the general population, and it is not listed in the CISA KEV catalog. The likely attack vector is an HTTP or HTTPS request with a crafted X-Forwarded-For header containing a spoofed IP address; the attacker need only send this request to a system that uses the RealIP middleware without a trusted‑proxy whitelist.