The CVSS 6.5 rating for CVE-2026-72817 in go-chi/chi's RealIP middleware warrants skepticism. The score conflates a library configuration dependency with a traditional vulnerability, and the actual risk profile hinges entirely on how your service is deployed.
The RealIP middleware extracts client IPs from X-Forwarded-For headers. The reported issue resolves the first IP in the chain rather than the last—but this is only exploitable when your service sits behind a misconfigured or untrusted proxy, or is exposed directly to the internet without proxy validation. Behind a properly configured nginx, AWS ALB, or load balancer that your team controls, this is not a meaningful attack vector. The EPSS score of 0.00185 reflects this: automated exploitation is extremely unlikely because the precondition (untrusted X-Forwarded-For input) rarely exists in production environments using standard architectures.
More importantly, IP-based access controls are inherently weak. When RealIP middleware gates something, it's typically audit logging, rate limiting, or geo-blocking—not authentication. Bypassing it yields wrong logging data or a circumvented rate limit, not code execution. The blast radius is genuinely narrower than the CVSS implies.
Your action steps: First, determine whether your chi service is directly exposed or sits behind a proxy you control. If behind a trusted proxy with proper configuration, deprioritize this CVE—your exposure is theoretical. If directly exposed or behind an untrusted upstream, treat this as a MEDIUM priority and audit your trusted proxy configuration. Second, do not assume that upgrading to 5.3.0 resolves the risk if you don't reconfigure your trusted proxy settings. The fix may have added safer API options while preserving backward-compatible defaults. The upgrade alone creates false assurance if the underlying configuration remains unchanged. Third, recognize that this CVE addresses chi specifically, not the broader pattern of X-Forwarded-For trust in the ecosystem—other HTTP utilities may share this behavior without receiving CVEs.
Prioritize based on actual exposure, not the CVSS number alone.