{"id":"CVE-2025-71405","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-14T12:16:43.297","lastModified":"2026-10-08T16:16:53.587","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft."},{"lang":"es","value":"Las versiones de chi anteriores a la v5.2.2 contienen una vulnerabilidad de redirección abierta en la función de middleware RedirectSlashes que utiliza el encabezado Host para construir URLs de redirección. Los atacantes pueden manipular el encabezado Host para redirigir a los usuarios a hosts arbitrarios, lo que permite ataques de phishing y robo de credenciales."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"go-chi","product":"chi","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/go-chi/chi/v5","versions":[{"version":"0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.2.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T18:57:32.118107Z","id":"CVE-2025-71405","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-before-open-redirect-via-redirectslashes","source":"disclosure@vulncheck.com"},{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}