CVE-2025-71405CWE-601

CVE-2025-71405

published August 14, 2026

CVSS
5.1
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00388 · 31.7th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-08-14T16:16Z
References (3)
https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93 · [email protected]https://www.vulncheck.com/advisories/go-chi-chi-before-open-redirect-via-redirectslashes · [email protected]https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 AUG 11:35Z
    go-chi chi before v5.2.2 Open Redirect via RedirectSlashes
    cvelistv5