CVE-2026-72816
UnscoredAdvisory
Published 24 Jul 2026In the index since 5 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- 0.002
- 12th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 201
- of 17,781 indexed, latest versions
- Container images
- 181
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi
Carried by container images the latest versions of 201 of 17,781 indexed charts deploy, on 181 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v5.0.0, v5.0.2, v5.0.3, v5.0.7+12 more | 5.3.0 | 181 |
- OSV records
- GO-2026-5777
- Also known as
- GHSA-rjr7-jggh-pgcp
Charts affected
201 by stars
Container images carrying it
181 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 7ea1820c1da1 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 3776500fde82 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 90a10c5c6793 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | d06892218680 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 0e02ef538ef0 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | aab0c99d313f | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 73689c430946 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | bad89a915768 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | ed99c430e159 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 3c1ee82d450d | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | d1e914e6d6b9 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 8637f0482ed1 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | f0f0075b0d45 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 322f5f8cc105 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | b5a06a6e13b9 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 0a580fe3a032 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 66d353e7693f | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 49800ff775f3 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 5afcab98d9d7 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 31060be60bec | github.com/ | 5.3.0 | 1 |
| public.ecr.aws/ | f1348a65664a | github.com/ | 5.3.0 | 1 |
| public.ecr.aws/ | 5ca2d500d374 | github.com/ | 5.3.0 | 1 |
| public.ecr.aws/ | a94d2d4aae85 | github.com/ | 5.3.0 | 1 |
| public.ecr.aws/ | e97e0e7a2088 | github.com/ | 5.3.0 | 1 |
| public.ecr.aws/ | 14f3dfbc0225 | github.com/ | 5.3.0 | 1 |
| public.ecr.aws/ | b9a7d6bc2a0c | github.com/ | 5.3.0 | 1 |
| public.ecr.aws/ | 9083e60c38bc | github.com/ | 5.3.0 | 1 |
| quay.io/ | 0d03a6aad575 | github.com/ | 5.3.0 | 1 |
| quay.io/ | 8577eb292a01 | github.com/ | 5.3.0 | 1 |
| quay.io/ | dcf583aba224 | github.com/ | 5.3.0 | 1 |
| registry.gitlab.com/ | f2194e526915 | github.com/ | 5.3.0 | 1 |