CVE-2025-71405

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71405", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-18T12:38:41.077Z", "datePublished": "2026-08-14T11:35:23.411Z", "dateUpdated": "2026-10-08T15:21:34.652Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:21:34.652Z"}, "datePublic": "2025-06-20T00:00:00.000Z", "title": "go-chi chi before v5.2.2 Open Redirect via RedirectSlashes", "descriptions": [{"lang": "en", "value": "chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "URL Redirection to Untrusted Site ('Open Redirect')", "cweId": "CWE-601", "type": "CWE"}]}], "affected": [{"vendor": "go-chi", "product": "chi", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/go-chi/chi/v5", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "5.2.2"}, {"version": "5.2.2", "status": "unaffected", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-vrw8-fxc6-2r93)"}, {"name": "VulnCheck Advisory: go-chi chi before v5.2.2 Open Redirect via RedirectSlashes", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/go-chi-chi-before-open-redirect-via-redirectslashes"}], "credits": [{"lang": "en", "value": "anuraagbaishya", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T18:57:32.118107Z", "id": "CVE-2025-71405", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T18:57:43.537Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-71405", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T18:57:32.118107Z"}}}], "references": [{"url": "https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T18:57:15.202Z"}}], "cna": {"title": "go-chi chi before v5.2.2 Open Redirect via RedirectSlashes", "credits": [{"lang": "en", "type": "reporter", "value": "anuraagbaishya"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "go-chi", "product": "chi", "versions": [{"status": "affected", "version": "0", "lessThan": "5.2.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.2.2", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/go-chi/chi/v5", "defaultStatus": "unaffected"}], "datePublic": "2025-06-20T00:00:00.000Z", "references": [{"url": "https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93", "name": "GitHub Security Advisory (GHSA-vrw8-fxc6-2r93)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/go-chi-chi-before-open-redirect-via-redirectslashes", "name": "VulnCheck Advisory: go-chi chi before v5.2.2 Open Redirect via RedirectSlashes", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:21:34.652Z"}}}, "cveMetadata": {"cveId": "CVE-2025-71405", "state": "PUBLISHED", "dateUpdated": "2026-10-08T15:21:34.652Z", "dateReserved": "2026-07-18T12:38:41.077Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-14T11:35:23.411Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/go-chi/chi/v5", "product": "chi", "vendor": "go-chi", "versions": [{"lessThan": "5.2.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "5.2.2", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft."}, {"lang": "es", "value": "Las versiones de chi anteriores a la v5.2.2 contienen una vulnerabilidad de redirecci\u00f3n abierta en la funci\u00f3n de middleware RedirectSlashes que utiliza el encabezado Host para construir URLs de redirecci\u00f3n. Los atacantes pueden manipular el encabezado Host para redirigir a los usuarios a hosts arbitrarios, lo que permite ataques de phishing y robo de credenciales."}], "id": "CVE-2025-71405", "lastModified": "2026-10-08T16:16:53.587", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71405", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-14T18:57:32.118107Z", "version": "2.0.3"}}]}, "published": "2026-08-14T12:16:43.297", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/go-chi-chi-before-open-redirect-via-redirectslashes"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.2.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.2.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "chi", "source": "cna", "vendor": "go-chi"}, "product": "chi", "vendor": "go-chi"}], "created": "2026-08-14T12:45:17.217909+00:00", "updated": "2026-08-14T13:00:10.982287+00:00", "vendors": ["go-chi", "go-chi$PRODUCT$chi"]}