CVE-2025-71405: go-chi chi Open Redirect

CVSS: 5.1v4.0MediumDeferred

AliasesUBUNTU-CVE-2025-71405DEBIAN-CVE-2025-71405CGA-26gq-gfw8-92gw+165 more

Published 14-08-2026Last modified 08-10-2026

Vulnerability summary

CVE-2025-71405 is a medium (CVSS 5.1) Open Redirect vulnerability in go-chi chi. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.4% of scored vulnerabilities.

Overall risk

20/100

0100

Low · default modelHow is this calculated?

CVSS score

5.1/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.39%

0%100%

Low · +0.08 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 1 · Downstream 0 · Related 1

GHSA-XCVF-46F4-XWXF CGA-PFH9-HHCG-HHH3

Timeline

14-08-2026
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.

CVSS metrics

7 scores · 7 sources · 1 version

v4.05.1

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

+0.08 pp

From 0.31% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Affected systems

Chainguard82 products

buf< 1.55.1-r1
caddy< 2.10.0-r2
caddy-fips< 2.10.0-r2
caddy-man< 2.10.0-r2
caddy-src< 2.10.0-r2

cloudflared< 2025.6.1-r1
dapr-1.14< 1.14.5-r5
dapr-1.15< 1.15.5-r3
dapr-daprd-1.14< 1.14.5-r5
dapr-daprd-1.14-oci-compat< 1.14.5-r5
dapr-daprd-1.15< 1.15.5-r3
dapr-daprd-1.15-oci-compat< 1.15.5-r3
dapr-daprd-fips-1.14< 1.14.5-r5
dapr-daprd-fips-1.14-oci-compat< 1.14.5-r5
dapr-daprd-fips-1.15< 1.15.5-r2
dapr-daprd-fips-1.15-oci-compat< 1.15.5-r2
dapr-fips-1.14< 1.14.5-r5
dapr-fips-1.15< 1.15.5-r2
dapr-injector-1.14< 1.14.5-r5
dapr-injector-1.14-oci-compat< 1.14.5-r5
dapr-injector-1.15< 1.15.5-r3
dapr-injector-1.15-oci-compat< 1.15.5-r3
dapr-injector-fips-1.14< 1.14.5-r5
dapr-injector-fips-1.14-oci-compat< 1.14.5-r5
dapr-injector-fips-1.15< 1.15.5-r2
dapr-injector-fips-1.15-oci-compat< 1.15.5-r2
dapr-operator-1.14< 1.14.5-r5
dapr-operator-1.14-oci-compat< 1.14.5-r5
dapr-operator-1.15< 1.15.5-r3
dapr-operator-1.15-oci-compat< 1.15.5-r3
dapr-operator-fips-1.14< 1.14.5-r5
dapr-operator-fips-1.14-oci-compat< 1.14.5-r5
dapr-operator-fips-1.15< 1.15.5-r2
dapr-operator-fips-1.15-oci-compat< 1.15.5-r2
dapr-placement-1.14< 1.14.5-r5
dapr-placement-1.14-oci-compat< 1.14.5-r5
dapr-placement-1.15< 1.15.5-r3
dapr-placement-1.15-oci-compat< 1.15.5-r3
dapr-placement-fips-1.14< 1.14.5-r5
dapr-placement-fips-1.14-oci-compat< 1.14.5-r5
dapr-placement-fips-1.15< 1.15.5-r2
dapr-placement-fips-1.15-oci-compat< 1.15.5-r2
dapr-scheduler-1.14< 1.14.5-r5
dapr-scheduler-1.14-oci-compat< 1.14.5-r5
dapr-scheduler-1.15< 1.15.5-r3
dapr-scheduler-1.15-oci-compat< 1.15.5-r3
dapr-scheduler-fips-1.14< 1.14.5-r5
dapr-scheduler-fips-1.14-oci-compat< 1.14.5-r5
dapr-scheduler-fips-1.15< 1.15.5-r2
dapr-scheduler-fips-1.15-oci-compat< 1.15.5-r2
dapr-sentry-1.14< 1.14.5-r5
dapr-sentry-1.14-oci-compat< 1.14.5-r5
dapr-sentry-1.15< 1.15.5-r3
dapr-sentry-1.15-oci-compat< 1.15.5-r3
dapr-sentry-fips-1.14< 1.14.5-r5
dapr-sentry-fips-1.14-oci-compat< 1.14.5-r5
dapr-sentry-fips-1.15< 1.15.5-r2
dapr-sentry-fips-1.15-oci-compat< 1.15.5-r2
gitness< 3.2.0-r2
gogatekeeper< 3.5.0-r0
gogatekeeper-compat< 3.5.0-r0
karma< 0.121-r3
kyverno-policy-reporter-ui< 2.3.10-r2
kyverno-policy-reporter-ui-compat< 2.3.10-r2
kyverno-policy-reporter-ui-fips< 2.3.10-r2
kyverno-policy-reporter-ui-fips-compat< 2.3.10-r2
rclone< 1.70.1-r1
rclone-compat< 1.70.1-r1
rclone-fips< 1.70.1-r1
rclone-fips-compat< 1.70.1-r1
sftpgo< 2.6.6-r6
step< 0.28.6-r5
step-ca< 0.28.3-r5
step-ca-fips< 0.28.3-r6
step-fips< 0.28.6-r6
step-issuer< 0.9.8-r5
step-issuer-compat< 0.9.8-r5
step-issuer-fips< 0.9.8-r5
step-issuer-fips-compat< 0.9.8-r5
telegraf-1.35< 1.35.0-r2
tkn< 0.41.0-r2
tkn-fips< 0.41.0-r2

Show all 82

Wolfi19 products

buf< 1.55.1-r1
caddy< 2.10.0-r2
caddy-man< 2.10.0-r2
caddy-src< 2.10.0-r2
cloudflared< 2025.6.1-r1

Show all 19

Debian1 product

golang-github-go-chi-chiAll versions (No fix recorded) | < 5.2.3-1

Github.com/go-chi/chi1 product

v5< 5.2.2 | ≥ 5.2.1, < 5.2.2

Go-chi1 product

chi< 5.2.2

Ubuntu1 product

golang-github-go-chi-chiAll versions (No fix recorded)

6 vendors · 105 products

References

9 links

github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93Vendor AdvisoryREPORTWEBAdvisory
www.vulncheck.com/advisories/go-chi-chi-before-open-redirect-via-redirectslashesThird Party AdvisoryREPORTAdvisoryWEB
ubuntu.com/security/CVE-2025-71405REPORT
www.cve.org/CVERecord?id=CVE-2025-71405REPORT
security-tracker.debian.org/tracker/CVE-2025-71405Advisory
github.com/go-chi/chi/commit/1be7ad938cc9c5b39a9dea01a5c518848928ab65WEBFIX
github.com/go-chi/chiPACKAGE
github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71405.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-71405Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities