The go-chi/chi library, specifically versions 0.9.0 up to but not including 5.3.0, has an IP spoofing vulnerability in its RealIP middleware. This middleware determines the request source IP by taking the first IP address from the X-Forwarded-For HTTP header without verifying whether the proxy that added this header is trusted. An attacker can exploit this by inserting a forged IP as the first value in the X-Forwarded-For header, causing the application to incorrectly identify the source IP. This can lead to bypassing IP-based access controls or generating misleading request logs.

The vulnerability allows an unauthenticated attacker to spoof the source IP address of HTTP requests. This can result in bypassing IP-based access restrictions or falsifying logs that rely on source IP information. The CVSS 4.0 base score is 6.9 (medium severity), indicating a significant but not critical risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid relying solely on the RealIP middleware for source IP validation or implement additional validation of trusted proxies before trusting the X-Forwarded-For header.