CVE-2026-122132

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122132", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T18:13:11.154Z", "datePublished": "2026-11-04T20:36:51.758Z", "dateUpdated": "2026-11-05T19:41:43.032Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T20:36:51.758Z"}, "datePublic": "2026-10-23T00:00:00.000Z", "title": "go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware", "descriptions": [{"lang": "en", "value": "go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "URL Redirection to Untrusted Site ('Open Redirect')", "cweId": "CWE-601", "type": "CWE"}]}], "affected": [{"vendor": "go-chi", "product": "chi", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/go-chi/chi/v5", "versions": [{"version": "5.2.2", "status": "affected", "lessThanOrEqual": "5.5.0", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/go-chi/chi/pull/1238", "tags": ["issue-tracking", "patch"], "name": "Pull Request #1238"}, {"url": "https://github.com/go-chi/chi", "tags": ["product"]}, {"url": "https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8", "tags": ["related", "vendor-advisory"], "name": "GitHub Security Advisory (GHSA-mqqf-5wvp-8fh8)"}, {"url": "https://github.com/go-chi/chi/blob/v5.5.0/middleware/strip.go#L41-L69", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/go-chi-chi-5.2.2-through-5.5.0-open-redirect-via-redirectslashes-middleware"}], "credits": [{"lang": "en", "value": "Zachariah Mithani (AploSec)", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T19:40:43.390519Z", "id": "CVE-2026-122132", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:41:43.032Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122132", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T19:40:43.390519Z"}}}], "references": [{"url": "https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:40:57.814Z"}}], "cna": {"title": "go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware", "credits": [{"lang": "en", "type": "finder", "value": "Zachariah Mithani (AploSec)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "go-chi", "product": "chi", "versions": [{"status": "affected", "version": "5.2.2", "versionType": "custom", "lessThanOrEqual": "5.5.0"}], "packageURL": "pkg:golang/github.com/go-chi/chi/v5", "defaultStatus": "unaffected"}], "datePublic": "2026-10-23T00:00:00.000Z", "references": [{"url": "https://github.com/go-chi/chi/pull/1238", "name": "Pull Request #1238", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/go-chi/chi", "tags": ["product"]}, {"url": "https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8", "name": "GitHub Security Advisory (GHSA-mqqf-5wvp-8fh8)", "tags": ["related", "vendor-advisory"]}, {"url": "https://github.com/go-chi/chi/blob/v5.5.0/middleware/strip.go#L41-L69", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/go-chi-chi-5.2.2-through-5.5.0-open-redirect-via-redirectslashes-middleware", "name": "VulnCheck Advisory: go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T20:36:51.758Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122132", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:41:43.032Z", "dateReserved": "2026-11-04T18:13:11.154Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-04T20:36:51.758Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/go-chi/chi/v5", "product": "chi", "vendor": "go-chi", "versions": [{"lessThanOrEqual": "5.5.0", "status": "affected", "version": "5.2.2", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725."}], "id": "CVE-2026-122132", "lastModified": "2026-11-05T20:17:49.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122132", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T19:40:43.390519Z", "version": "2.0.3"}}]}, "published": "2026-11-04T21:18:08.890", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/go-chi/chi"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/go-chi/chi/blob/v5.5.0/middleware/strip.go#L41-L69"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/go-chi/chi/pull/1238"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/go-chi-chi-5.2.2-through-5.5.0-open-redirect-via-redirectslashes-middleware"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/go-chi/chi: go-chi: Open redirect via encoded tab characters in RedirectSlashes middleware", "id": "2567552", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567552"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-601", "details": ["go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.", "A flaw was found in go-chi. This open redirect vulnerability allows a remote attacker to redirect users to arbitrary external websites by enticing them to follow a specially crafted link containing an encoded tab character in the request path. When the RedirectSlashes middleware issues a redirection response, web browsers strip the tab character and interpret the destination as an external host, potentially exposing victims to phishing or credential theft."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122132", "public_date": "2026-11-04T20:36:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122132\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122132\nhttps://github.com/go-chi/chi\nhttps://github.com/go-chi/chi/blob/v5.5.0/middleware/strip.go#L41-L69\nhttps://github.com/go-chi/chi/pull/1238\nhttps://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8\nhttps://www.vulncheck.com/advisories/go-chi-chi-5.2.2-through-5.5.0-open-redirect-via-redirectslashes-middleware"], "statement": "This vulnerability is rated as Moderate by Red Hat because exploitation depends on tricking a user into navigating to a malicious link, and the blast radius is restricted to client-side redirection rather than direct server or data compromise. Exposure only arises in Go microservices that intentionally enable the optional slash-redirection middleware during router setup. Applications that do not activate this routing handler or that filter request paths at an upstream proxy remain unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.2.2,5.5.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "chi", "source": "cna", "vendor": "go-chi"}, "product": "chi", "vendor": "go-chi"}], "created": "2026-11-04T21:45:14.732722+00:00", "updated": "2026-11-04T22:45:15.218930+00:00", "vendors": ["go-chi", "go-chi$PRODUCT$chi"]}