CVE-2026-72817
UnscoredAdvisory
Published 24 Jul 2026In the index since 5 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- 0.002
- 5th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 201
- of 17,781 indexed, latest versions
- Container images
- 181
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi
Carried by container images the latest versions of 201 of 17,781 indexed charts deploy, on 181 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v5.0.0, v5.0.2, v5.0.3, v5.0.7+12 more | 5.3.0 | 181 |
- OSV records
- GO-2026-5775
- Also known as
- GHSA-9g5q-2w5x-hmxf
Charts affected
201 by stars
Container images carrying it
181 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| stashapp/ | df744af5a0c9 | github.com/ | 5.3.0 | 1 |
| stashapp/ | a534c8afdf39 | github.com/ | 5.3.0 | 1 |
| supabase/ | 385184459f57 | github.com/ | 5.3.0 | 1 |
| supabase/ | ba4ddc594b0b | github.com/ | 5.3.0 | 1 |
| treeverse/ | bda61b3fe5d8 | github.com/ | 5.3.0 | 1 |
| treeverse/ | 478f37a6cffc | github.com/ | 5.3.0 | 1 |
| treeverse/ | fb7a0d90f77e | github.com/ | 5.3.0 | 1 |
| tykio/ | 92509e00e618 | github.com/ | 5.3.0 | 1 |
| udhos/ | 8a7042db82ce | github.com/ | 5.3.0 | 1 |
| wallarm/ | f1cb26db1f5b | github.com/ | 5.3.0 | 1 |
| wallarm/ | a321bc974a19 | github.com/ | 5.3.0 | 1 |
| gcr.io/ | 4d9a4ec0379d | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | a6d99f323d30 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | b15824464acb | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | dfbef0285e14 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | b1857871e06c | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 36ce246d884e | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 16907aae5de1 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | d4022cd32df5 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 10b7945d4f09 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | b5b2b02e4c4e | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 13290b9a64af | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 16759fa523f8 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 6fde1edc0983 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | bd6bea5e487c | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 896e4926e0d7 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 546d074f0dfb | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | fce5b6fd161c | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 10ae596d296e | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 9b4e856d18f6 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 5c47ef99443a | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 5470b2ec3161 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | a0b272f6682a | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 24a0113d5fb0 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 6dfdbc9853bb | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | d39a9d7c3e1b | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | c8ac95a30c31 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 21b284fb00f2 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | ca01f5ab95f7 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 015f5ba04bcb | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | a752b6aee537 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 6d4106724d56 | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 4d763d58f11d | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 2fbce0601a3c | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 7390a215d63c | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 560a16a56d4e | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 528f2174fa2f | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 5dfa86b6451f | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | 45e744fc623f | github.com/ | 5.3.0 | 1 |
| ghcr.io/ | a5e17b48f08e | github.com/ | 5.3.0 | 1 |