Medium severity · published Aug 14, 2026
CVE-2025-71405
go-chi chi before v5.2.2 Open Redirect via RedirectSlashes
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
chi · go-chi
before 5.2.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-71405
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-71405
vendor-advisory
https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93
third-party-advisory
https://www.vulncheck.com/advisories/go-chi-chi-before-open-redirect-via-redirectslashes
More from chi
6.9
CVE-2026-72815
go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header
6.5
CVE-2026-72817
go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For
6.5
CVE-2026-72816
go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware
4.8
CVE-2026-114437
Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For