RHSA-2026:49718MediumCVSS 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
August 3, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (3)

CVE-2026-72815 →CVE-2026-72816 →CVE-2026-72817 →

📋 Description

CVE-2026-72815 — github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls CVE-2026-72816 — github.com/go-chi/chi: go-chi/chi: IP Spoofing via RealIP Middleware allows bypassing access controls CVE-2026-72817 — github.com/go-chi/chi/middleware: go-chi/chi: IP spoofing via X-Forwarded-For header manipulation

🎯 Affected products4

  • Red Hat Hardened Images
  • spire1-14-main@aarch64 as a component of Red Hat Hardened Images
  • spire1-14-main@src as a component of Red Hat Hardened Images
  • spire1-14-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Do not rely on the `RealIP` middleware when accepting connections from untrusted networks. Instead, configure an upstream reverse proxy (such as NGINX or HAProxy) to overwrite or sanitize client-supplied `X-Forwarded-For` headers before forwarding traffic to the application. Workaround: Do not use the `chi/middleware.RealIP` middleware when receiving traffic directly from untrusted networks or unverified proxies. Instead, strip or sanitize client-supplied forwarding headers at an upstream edge proxy or reverse proxy (such as NGINX or HAProxy) before requests reach the application. Workaround: Disable the default `RealIP` middleware and replace it with a proxy-aware middleware (such as `httputil.ReverseProxy` or custom header parsing) that strictly validates upstream reverse proxies against an explicit list of trusted CIDR ranges before accepting `X-Forwarded-For` headers.

🔗 References (7)