Medium
golang-github-go-chi-chi — security advisory
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.
- Products
- golang-github-go-chi-chi
- Affected versions
- 1.5.1-2, 5.0.7-1, 5.2.0-1, 5.2.3-1, 5.3.0-1
- Fixed versions
- Not specified
- CVEs
- CVE-2025-71405
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:52 UTC · Revision 1
Source evidence
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.
osv:UBUNTU-CVE-2025-71405
golang-github-go-chi-chi
Fixed versions: Not specified
golang-github-go-chi-chi
Fixed versions: Not specified
golang-github-go-chi-chi
Fixed versions: Not specified
golang-github-go-chi-chi
Fixed versions: Not specified
Complete source record
{
"id": "380cc8394f6ad03108e9b3c556b56ce11dc490e3dcae47367508ef2a5353d675",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-71405",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2025-71405",
"summary": "chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.",
"evidence": "osv:UBUNTU-CVE-2025-71405",
"products": [
{
"name": {
"value": "golang-github-go-chi-chi",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.1-2",
"evidence": "/affected/0/versions"
},
{
"value": "5.0.7-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "golang-github-go-chi-chi",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.0.7-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "golang-github-go-chi-chi",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.2.3-1",
"evidence": "/affected/2/versions"
},
{
"value": "5.3.0-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "golang-github-go-chi-chi",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.2.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "5.2.3-1",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2025-71405",
"aliases": [
"UBUNTU-CVE-2025-71405"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-github-go-chi-chi",
"purl": "pkg:deb/ubuntu/golang-github-go-chi-chi?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.5.1-2",
"5.0.7-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-71405.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-go-chi-chi-dev",
"binary_version": "5.0.7-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-github-go-chi-chi",
"purl": "pkg:deb/ubuntu/golang-github-go-chi-chi?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"5.0.7-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-71405.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-go-chi-chi-dev",
"binary_version": "5.0.7-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-github-go-chi-chi",
"purl": "pkg:deb/ubuntu/golang-github-go-chi-chi?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"5.2.3-1",
"5.3.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-71405.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-go-chi-chi-dev",
"binary_version": "5.3.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-github-go-chi-chi",
"purl": "pkg:deb/ubuntu/golang-github-go-chi-chi?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"5.2.0-1",
"5.2.3-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-71405.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-go-chi-chi-dev",
"binary_version": "5.2.3-1"
}
]
}
}
],
"modified": "2026-10-17T12:57:35.248794587Z",
"provider": "osv",
"upstream": [
"CVE-2025-71405"
],
"references": [
"https://ubuntu.com/security/CVE-2025-71405",
"https://www.cve.org/CVERecord?id=CVE-2025-71405",
"https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93",
"https://www.vulncheck.com/advisories/go-chi-chi-before-open-redirect-via-redirectslashes"
]
},
"related_cves": [
{
"value": "CVE-2025-71405",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 357646,
"published_at": "2026-08-14T12:16:00+00:00"
}