CVE-2025-71405
5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Summary
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| go-chi | chi | 0 < 5.2.2 | affected |
| go-chi | chi | 5.2.2 | unaffected |
Weaknesses
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: partial
Additional References
References
- https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93
- https://www.vulncheck.com/advisories/go-chi-chi-before-open-redirect-via-redirectslashes
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.