CVE-2025-71405: medium-severity vulnerability in go-chi chi
go-chi chi before v5.2.2 Open Redirect via RedirectSlashes
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.4%
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
go-chi · chiRelated CVEs — go-chi chi
In the same product, most dangerous first.
CVE-2026-72815MEDIUMgo-chi chi v5.2.1 IP Spoofing via X-Forwarded-For HeaderEPSS 0.5%CVE-2026-72816MEDIUMgo-chi chi before 5.3.0 IP Spoofing via RealIP MiddlewareEPSS 0.3%CVE-2026-118681MEDIUMgo-chi chi before 5.5.0 Authentication Bypass via SupressNotFound MiddlewareEPSS 0.2%CVE-2026-72817MEDIUMgo-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-ForEPSS 0.2%CVE-2026-114437MEDIUMChi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-ForEPSS 0.1%