CVE-2025-71405 MEDIUM

CVE-2025-71405: go-chi chi before v5.2.2 Open Redirect via RedirectSlashes

Vendor Go-Chi
Product chi
Weakness CWE-601 · Open redirect
Published August 14, 2026
Last update August 14, 2026

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.

Key dates

02Disclosure timeline

August 14, 2026 CVE published