The vulnerability is in the RealIP middleware of the go-chi routing library. The middleware takes the first value of the X-Forwarded-For header as the client’s IP, without checking whether the header originates from a trusted proxy. A malicious user can prepend a forged IP address as the first list element, causing the framework to record the request as coming from that IP. This allows an attacker to make requests appear to originate from any address, potentially bypassing IP-based access controls and corrupting logs that rely on the remote address.

The affected product is the go-chi HTTP routing library, known as chi, version 0.9.0 up to, but not including, 5.3.0. Any installation that uses the RealIP middleware while processing client requests is vulnerable.

The CVSS score of 6.9 places this vulnerability in the moderate range. EPSS is not available, meaning no exposure data is published yet. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending an HTTP request with a forged X-Forwarded-For header containing a spoofed IP address. Because the RealIP middleware lacks validation of trusted proxies, this can be done over both HTTP and HTTPS. The attack can result in IP spoofing, enabling bypass of IP-based security controls and falsifying audit logs.