[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-72817":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":341,"aliases":342,"duplicate_of":9,"upstream":349,"downstream":350,"duplicates":369,"related":370,"reserved_at":9,"published_at":379,"modified_at":380,"state":381,"summary":382,"references_raw":391,"kevs":440,"epss":441,"epss_history":444,"metrics":545,"affected":567},"CVE-2026-72817","go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-345","Insufficient Verification of Data Authenticity","The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.","weakness","Draft","Class",[19,23,76,88,109,113,117,121,125,129,133,337],{"id":20,"name":21,"techniques":22},"CAPEC-111","JSON Hijacking (aka JavaScript Hijacking)",[],{"id":24,"name":25,"techniques":26},"CAPEC-141","Cache Poisoning",[27],{"id":28,"name":29,"tactics":30,"countermeasures":37},"T1557.002","ARP Cache Poisoning",[31,34],{"id":32,"name":33},"TA0031","Credential Access",{"id":35,"name":36},"TA0100","Collection",[38,43,48,52,56,60,64,68,72],{"id":39,"name":40,"tactic":41},"D3-NTF","Network Traffic Filtering",{"name":42},"Isolate",{"id":44,"name":45,"tactic":46},"D3-NTCD","Network Traffic Community Deviation",{"name":47},"Detect",{"id":49,"name":50,"tactic":51},"D3-RTSD","Remote Terminal Session Detection",{"name":47},{"id":53,"name":54,"tactic":55},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":47},{"id":57,"name":58,"tactic":59},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":47},{"id":61,"name":62,"tactic":63},"D3-CSPP","Client-server Payload Profiling",{"name":47},{"id":65,"name":66,"tactic":67},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":47},{"id":69,"name":70,"tactic":71},"D3-NTSA","Network Traffic Signature Analysis",{"name":47},{"id":73,"name":74,"tactic":75},"D3-APCA","Application Protocol Command Analysis",{"name":47},{"id":77,"name":78,"techniques":79},"CAPEC-142","DNS Cache Poisoning",[80],{"id":81,"name":82,"tactics":83,"countermeasures":87},"T1584.002","DNS Server",[84],{"id":85,"name":86},"TA0042","Resource Development",[],{"id":89,"name":90,"techniques":91},"CAPEC-148","Content Spoofing",[92],{"id":93,"name":94,"tactics":95,"countermeasures":99},"T1491","Defacement",[96],{"id":97,"name":98},"TA0105","Impact",[100,105],{"id":101,"name":102,"tactic":103},"D3-DNR","Decoy Network Resource",{"name":104},"Deceive",{"id":106,"name":107,"tactic":108},"D3-NRAM","Network Resource Access Mediation",{"name":42},{"id":110,"name":111,"techniques":112},"CAPEC-218","Spoofing of UDDI/ebXML Messages",[],{"id":114,"name":115,"techniques":116},"CAPEC-384","Application API Message Manipulation via Man-in-the-Middle",[],{"id":118,"name":119,"techniques":120},"CAPEC-385","Transaction or Event Tampering via Application API Manipulation",[],{"id":122,"name":123,"techniques":124},"CAPEC-386","Application API Navigation Remapping",[],{"id":126,"name":127,"techniques":128},"CAPEC-387","Navigation Remapping To Propagate Malicious Content",[],{"id":130,"name":131,"techniques":132},"CAPEC-388","Application API Button Hijacking",[],{"id":134,"name":135,"techniques":136},"CAPEC-665","Exploitation of Thunderbolt Protection Flaws",[137,173,213],{"id":138,"name":139,"tactics":140,"countermeasures":147},"T1211","Exploitation for Stealth",[141,144],{"id":142,"name":143},"TA0030","Defense Evasion",{"id":145,"name":146},"TA0005","Stealth",[148,153,157,161,165,169],{"id":149,"name":150,"tactic":151},"D3-PSEP","Process Segment Execution Prevention",{"name":152},"Harden",{"id":154,"name":155,"tactic":156},"D3-MBT","Memory Boundary Tracking",{"name":47},{"id":158,"name":159,"tactic":160},"D3-PCSV","Process Code Segment Verification",{"name":47},{"id":162,"name":163,"tactic":164},"D3-SFCV","Stack Frame Canary Validation",{"name":152},{"id":166,"name":167,"tactic":168},"D3-SSC","Shadow Stack Comparisons",{"name":47},{"id":170,"name":171,"tactic":172},"D3-SAOR","Segment Address Offset Randomization",{"name":152},{"id":174,"name":175,"tactics":176,"countermeasures":182},"T1542.002","Component Firmware",[177,178,179],{"id":142,"name":143},{"id":145,"name":146},{"id":180,"name":181},"TA0110","Persistence",[183,187,191,195,199,204,209],{"id":184,"name":185,"tactic":186},"D3-FEMC","Firmware Embedded Monitoring Code",{"name":47},{"id":188,"name":189,"tactic":190},"D3-FV","Firmware Verification",{"name":47},{"id":192,"name":193,"tactic":194},"D3-FBA","Firmware Behavior Analysis",{"name":47},{"id":196,"name":197,"tactic":198},"D3-SU","Software Update",{"name":152},{"id":200,"name":201,"tactic":202},"D3-SWI","Software Inventory",{"name":203},"Model",{"id":205,"name":206,"tactic":207},"D3-RS","Restore Software",{"name":208},"Restore",{"id":210,"name":211,"tactic":212},"D3-AVE","Asset Vulnerability Enumeration",{"name":203},{"id":214,"name":215,"tactics":216,"countermeasures":223},"T1556","Modify Authentication Process",[217,218,221,222],{"id":142,"name":143},{"id":219,"name":220},"TA0112","Defense Impairment",{"id":180,"name":181},{"id":32,"name":33},[224,228,232,237,241,245,249,253,257,261,265,269,273,277,281,285,289,293,297,301,305,309,313,317,321,325,329,333],{"id":225,"name":226,"tactic":227},"D3-LFP","Local File Permissions",{"name":42},{"id":229,"name":230,"tactic":231},"D3-HBPI","Hardware-based Process Isolation",{"name":42},{"id":233,"name":234,"tactic":235},"D3-FEV","File Eviction",{"name":236},"Evict",{"id":238,"name":239,"tactic":240},"D3-HS","Host Shutdown",{"name":236},{"id":242,"name":243,"tactic":244},"D3-PSMD","Process Self-Modification Detection",{"name":47},{"id":246,"name":247,"tactic":248},"D3-CQ","Content Quarantine",{"name":42},{"id":250,"name":251,"tactic":252},"D3-ABPI","Application-based Process Isolation",{"name":42},{"id":254,"name":255,"tactic":256},"D3-SFA","System File Analysis",{"name":47},{"id":258,"name":259,"tactic":260},"D3-PT","Process Termination",{"name":236},{"id":262,"name":263,"tactic":264},"D3-SCF","System Call Filtering",{"name":42},{"id":266,"name":267,"tactic":268},"D3-AM","Access Modeling",{"name":203},{"id":270,"name":271,"tactic":272},"D3-RC","Restore Configuration",{"name":208},{"id":274,"name":275,"tactic":276},"D3-FE","File Encryption",{"name":152},{"id":278,"name":279,"tactic":280},"D3-DF","Decoy File",{"name":104},{"id":282,"name":283,"tactic":284},"D3-FIM","File Integrity Monitoring",{"name":47},{"id":286,"name":287,"tactic":288},"D3-CF","Content Filtering",{"name":42},{"id":290,"name":291,"tactic":292},"D3-FA","File Analysis",{"name":47},{"id":294,"name":295,"tactic":296},"D3-WSAM","Web Session Access Mediation",{"name":42},{"id":298,"name":299,"tactic":300},"D3-CI","Configuration Inventory",{"name":203},{"id":302,"name":303,"tactic":304},"D3-RF","Restore File",{"name":208},{"id":306,"name":307,"tactic":308},"D3-PSA","Process Spawn Analysis",{"name":47},{"id":310,"name":311,"tactic":312},"D3-PLA","Process Lineage Analysis",{"name":47},{"id":314,"name":315,"tactic":316},"D3-RFAM","Remote File Access Mediation",{"name":42},{"id":318,"name":319,"tactic":320},"D3-CM","Content Modification",{"name":42},{"id":322,"name":323,"tactic":324},"D3-NTPM","Network Traffic Policy Mapping",{"name":203},{"id":326,"name":327,"tactic":328},"D3-KBPI","Kernel-based Process Isolation",{"name":42},{"id":330,"name":331,"tactic":332},"D3-PS","Process Suspension",{"name":236},{"id":334,"name":335,"tactic":336},"D3-HR","Host Reboot",{"name":236},{"id":338,"name":339,"techniques":340},"CAPEC-701","Browser in the Middle (BiTM)",[],[],[343,344,345,346,347,348],"DEBIAN-CVE-2026-72817","GHSA-9g5q-2w5x-hmxf","GO-2026-5775","UBUNTU-CVE-2026-72817","openSUSE-SU-2026:11578-1","openSUSE-SU-2026:11591-1",[],[351,353,355,357,359,361,363,365,367],{"_key":352},"OPENSUSE-SU-2026:11574-1",{"_key":354},"OPENSUSE-SU-2026:21653-1",{"_key":356},"OPENSUSE-SU-2026:21645-1",{"_key":358},"OPENSUSE-SU-2026:21670-1",{"_key":360},"RHSA-2026:49718",{"_key":362},"RHSA-2026:49732",{"_key":364},"RHSA-2026:54420",{"_key":366},"OPENSUSE-SU-2026:21793-1",{"_key":368},"OPENSUSE-SU-2026:11810-1",[],[371,372,373,374,375,376,377],{"_key":352},{"_key":354},{"_key":356},{"_key":358},{"_key":366},{"_key":368},{"_key":378},"CGA-VPHG-6R8R-9X6M","2026-08-14T11:35:28.824Z","2026-08-17T16:09:15.028Z","Deferred",{"cisa_kev":383,"cisa_ransomware":383,"cisa_vendor":9,"epss_severity":384,"epss_score":385,"severity":386,"severity_score":387,"severity_version":388,"severity_source":389,"severity_vector":390,"severity_status":381},false,"low",0.0015,"medium",6.9,"v4.0","cve.org","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",[392,403,408,413,418,422,427,431,435],{"url":393,"sources":394,"tags":398},"https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf",[389,395,396,397],"nvd","osv_go","osv_ubuntu",[399,400,401,402],"Vendor Advisory","WEB","Advisory","REPORT",{"url":404,"sources":405,"tags":406},"https://www.vulncheck.com/advisories/go-chi-chi-before-ip-spoofing-via-x-forwarded-for",[389,395,397],[407,402],"Third Party Advisory",{"url":409,"sources":410,"tags":412},"https://security-tracker.debian.org/tracker/CVE-2026-72817",[411],"osv_debian",[401],{"url":414,"sources":415,"tags":416},"https://github.com/go-chi/chi",[396],[417],"PACKAGE",{"url":419,"sources":420,"tags":421},"https://github.com/go-chi/chi/releases/tag/v5.3.0",[396],[400],{"url":423,"sources":424,"tags":425},"https://github.com/go-chi/chi/pull/967",[396],[426],"FIX",{"url":428,"sources":429,"tags":430},"https://ubuntu.com/security/CVE-2026-72817",[397],[402],{"url":432,"sources":433,"tags":434},"https://www.cve.org/CVERecord?id=CVE-2026-72817",[397],[402],{"url":436,"sources":437,"tags":439},"https://www.suse.com/security/cve/CVE-2026-72817",[438],"osv_opensuse",[400],[],{"date":442,"score":385,"percentile":443},"2026-09-19",0.04598,[445,448,451,454,457,460,463,466,469,472,475,478,481,484,487,490,492,495,498,501,504,507,509,512,515,518,521,523,525,527,530,532,535,538,541,544],{"date":446,"score":385,"percentile":447},"2026-08-15",0.04744,{"date":449,"score":385,"percentile":450},"2026-08-16",0.0471,{"date":452,"score":385,"percentile":453},"2026-08-17",0.04728,{"date":455,"score":385,"percentile":456},"2026-08-18",0.04736,{"date":458,"score":385,"percentile":459},"2026-08-19",0.0475,{"date":461,"score":385,"percentile":462},"2026-08-20",0.04757,{"date":464,"score":385,"percentile":465},"2026-08-21",0.04751,{"date":467,"score":385,"percentile":468},"2026-08-22",0.04755,{"date":470,"score":385,"percentile":471},"2026-08-23",0.04734,{"date":473,"score":385,"percentile":474},"2026-08-24",0.0444,{"date":476,"score":385,"percentile":477},"2026-08-25",0.04465,{"date":479,"score":385,"percentile":480},"2026-08-26",0.04473,{"date":482,"score":385,"percentile":483},"2026-08-27",0.0454,{"date":485,"score":385,"percentile":486},"2026-08-28",0.04521,{"date":488,"score":385,"percentile":489},"2026-08-29",0.04533,{"date":491,"score":385,"percentile":483},"2026-08-30",{"date":493,"score":385,"percentile":494},"2026-08-31",0.04537,{"date":496,"score":385,"percentile":497},"2026-09-01",0.04512,{"date":499,"score":385,"percentile":500},"2026-09-02",0.04517,{"date":502,"score":385,"percentile":503},"2026-09-03",0.04505,{"date":505,"score":385,"percentile":506},"2026-09-04",0.04506,{"date":508,"score":385,"percentile":503},"2026-09-05",{"date":510,"score":385,"percentile":511},"2026-09-06",0.04516,{"date":513,"score":385,"percentile":514},"2026-09-07",0.04495,{"date":516,"score":385,"percentile":517},"2026-09-08",0.04503,{"date":519,"score":385,"percentile":520},"2026-09-09",0.04526,{"date":522,"score":385,"percentile":486},"2026-09-10",{"date":524,"score":385,"percentile":500},"2026-09-11",{"date":526,"score":385,"percentile":511},"2026-09-12",{"date":528,"score":385,"percentile":529},"2026-09-13",0.04529,{"date":531,"score":385,"percentile":483},"2026-09-14",{"date":533,"score":385,"percentile":534},"2026-09-15",0.04549,{"date":536,"score":385,"percentile":537},"2026-09-16",0.04578,{"date":539,"score":385,"percentile":540},"2026-09-17",0.04587,{"date":542,"score":385,"percentile":543},"2026-09-18",0.046,{"date":442,"score":385,"percentile":443},[546,554,558,560,564],{"source":389,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":547,"cvss_v4_0":553},{"baseScore":548,"baseSeverity":549,"vectorString":550,"impactScore":551,"exploitabilityScore":552},6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",4.2,10,{"baseScore":387,"baseSeverity":549,"vectorString":390,"impactScore":9,"exploitabilityScore":9},{"source":395,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":555,"cvss_v4_0":556},{"baseScore":548,"baseSeverity":549,"vectorString":550,"impactScore":551,"exploitabilityScore":552},{"baseScore":387,"baseSeverity":549,"vectorString":557,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":411,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":559},{"baseScore":387,"baseSeverity":9,"vectorString":557,"impactScore":9,"exploitabilityScore":9},{"source":396,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":561},{"baseScore":562,"baseSeverity":9,"vectorString":563,"impactScore":9,"exploitabilityScore":9},8.7,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",{"source":397,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":565,"cvss_v4_0":566},{"baseScore":548,"baseSeverity":9,"vectorString":550,"impactScore":551,"exploitabilityScore":552},{"baseScore":387,"baseSeverity":9,"vectorString":390,"impactScore":9,"exploitabilityScore":9},[568,584,591,601,612,618,625,632,639,643,653],{"ecosystem":569,"name":570,"vendor":571,"product":570,"cpe_part":9,"purl_type":572,"purl_namespace":571,"purl_name":570,"source":9,"versions":573},"Debian","golang-github-go-chi-chi","debian","deb",[574,578,579,580],{"version":575,"is_range":576,"range_type":577,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":575,"is_range":576,"range_type":577,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":575,"is_range":576,"range_type":577,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":581,"is_range":576,"range_type":577,"version_start":9,"version_start_type":9,"version_end":582,"version_end_type":583,"fixed_in":9},"lt5_3_0_1","5.3.0-1","excluding",{"ecosystem":585,"name":570,"vendor":586,"product":570,"cpe_part":9,"purl_type":572,"purl_namespace":586,"purl_name":570,"source":9,"versions":587},"Ubuntu","ubuntu",[588,589,590],{"version":575,"is_range":576,"range_type":577,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":575,"is_range":576,"range_type":577,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":575,"is_range":576,"range_type":577,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":9,"name":592,"vendor":593,"product":592,"cpe_part":594,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":595},"chi","go-chi","a",[596],{"version":597,"is_range":576,"range_type":389,"version_start":598,"version_start_type":599,"version_end":600,"version_end_type":583,"fixed_in":9},">= 0.9.0, \u003C 5.3.0","0.9.0","including","5.3.0",{"ecosystem":602,"name":603,"vendor":604,"product":605,"cpe_part":9,"purl_type":606,"purl_namespace":604,"purl_name":605,"source":9,"versions":607},"Go","github.com/go-chi/chi/middleware","github.com/go-chi/chi","middleware","golang",[608],{"version":609,"is_range":576,"range_type":610,"version_start":598,"version_start_type":599,"version_end":611,"version_end_type":599,"fixed_in":9},"gte0_9_0_lte1_5_5","semver","1.5.5",{"ecosystem":602,"name":613,"vendor":604,"product":614,"cpe_part":9,"purl_type":606,"purl_namespace":604,"purl_name":614,"source":9,"versions":615},"github.com/go-chi/chi/v5","v5",[616],{"version":617,"is_range":576,"range_type":610,"version_start":9,"version_start_type":9,"version_end":600,"version_end_type":583,"fixed_in":9},"lt5_3_0",{"ecosystem":602,"name":619,"vendor":620,"product":605,"cpe_part":9,"purl_type":606,"purl_namespace":620,"purl_name":605,"source":9,"versions":621},"github.com/go-chi/chi/v2/middleware","github.com/go-chi/chi/v2",[622],{"version":623,"is_range":576,"range_type":610,"version_start":9,"version_start_type":9,"version_end":624,"version_end_type":599,"fixed_in":9},"lte2_1_1","2.1.1",{"ecosystem":602,"name":626,"vendor":627,"product":605,"cpe_part":9,"purl_type":606,"purl_namespace":627,"purl_name":605,"source":9,"versions":628},"github.com/go-chi/chi/v3/middleware","github.com/go-chi/chi/v3",[629],{"version":630,"is_range":576,"range_type":610,"version_start":9,"version_start_type":9,"version_end":631,"version_end_type":599,"fixed_in":9},"lte3_3_5","3.3.5",{"ecosystem":602,"name":633,"vendor":634,"product":605,"cpe_part":9,"purl_type":606,"purl_namespace":634,"purl_name":605,"source":9,"versions":635},"github.com/go-chi/chi/v4/middleware","github.com/go-chi/chi/v4",[636],{"version":637,"is_range":576,"range_type":610,"version_start":9,"version_start_type":9,"version_end":638,"version_end_type":599,"fixed_in":9},"lte4_1_3","4.1.3",{"ecosystem":602,"name":640,"vendor":613,"product":605,"cpe_part":9,"purl_type":606,"purl_namespace":613,"purl_name":605,"source":9,"versions":641},"github.com/go-chi/chi/v5/middleware",[642],{"version":617,"is_range":576,"range_type":610,"version_start":9,"version_start_type":9,"version_end":600,"version_end_type":583,"fixed_in":9},{"ecosystem":644,"name":645,"vendor":646,"product":647,"cpe_part":9,"purl_type":648,"purl_namespace":646,"purl_name":647,"source":9,"versions":649},"openSUSE","trivy","opensuse","trivy&distro=openSUSE Tumbleweed","rpm",[650],{"version":651,"is_range":576,"range_type":577,"version_start":9,"version_start_type":9,"version_end":652,"version_end_type":583,"fixed_in":9},"lt0_74_0_1_1","0.74.0-1.1",{"ecosystem":644,"name":654,"vendor":646,"product":655,"cpe_part":9,"purl_type":648,"purl_namespace":646,"purl_name":655,"source":9,"versions":656},"v2ray-core","v2ray-core&distro=openSUSE Tumbleweed",[657],{"version":658,"is_range":576,"range_type":577,"version_start":9,"version_start_type":9,"version_end":659,"version_end_type":583,"fixed_in":9},"lt5_53_0_1_1","5.53.0-1.1"]