CVE-2026-122132mediumCWE-601

CVE-2026-122132: fallo de gravedad media en go-chi chi

go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear chi+ Monitorear golang-github-go-chi-chi

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1epss 0.3%
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
go-chi · chi
CVEs relacionadas — go-chi chi

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-72815MEDIUMgo-chi chi v5.2.1 IP Spoofing via X-Forwarded-For HeaderEPSS 0.5%CVE-2025-71405MEDIUMgo-chi chi before v5.2.2 Open Redirect via RedirectSlashesEPSS 0.4%CVE-2026-72816MEDIUMgo-chi chi before 5.3.0 IP Spoofing via RealIP MiddlewareEPSS 0.3%CVE-2026-118681MEDIUMgo-chi chi before 5.5.0 Authentication Bypass via SupressNotFound MiddlewareEPSS 0.2%CVE-2026-72817MEDIUMgo-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-ForEPSS 0.2%CVE-2026-114437MEDIUMChi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-ForEPSS 0.1%