CVE-2025-71405
CVE-2025-71405 · go-chi chi before v5.2.2 Open Redirect via RedirectSlashes
This page contains facts from public vulnerability sources. Check the original advisory before updating.
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.
CVSS 5.1 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
chi
- Versions
- ≥ 0, < 5.2.2: Affected (semver)
- 5.2.2: Not affected (semver)
Update to 5.2.2
golang-github-go-chi-chi Debian:12
- Versions
- 5.0.7-1
- 5.1.0-1
- 5.2.0-1
- 5.2.3-1
- 5.2.5-1
- 5.3.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-github-go-chi-chi Debian:13
- Versions
- 5.2.0-1
- 5.2.3-1
- 5.2.5-1
- 5.3.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-github-go-chi-chi Debian:14
- Versions
- 5.2.0-1
- Affected ranges
- ECOSYSTEM: < 5.2.3-1
Update to 5.2.3-1
golang-github-go-chi-chi Ubuntu:22.04:LTS
- Versions
- 1.5.1-2
- 5.0.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-github-go-chi-chi Ubuntu:24.04:LTS
- Versions
- 5.0.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-github-go-chi-chi Ubuntu:26.10
- Versions
- 5.2.3-1
- 5.3.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-github-go-chi-chi Ubuntu:26.04:LTS
- Versions
- 5.2.0-1
- 5.2.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published