go-chi/chi: Go-chi/chi: Open Redirect vulnerability allows redirection to malicious websites
Published Feb 19, 2026
4.7
MEDIUMCVSS 3.1
EPSS 0.22%
Description
An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.
Affected products
No data.
No data.
No data.
External Secrets Operator for Red Hat OpenShift
external-secrets-operator/bitwarden-sdk-server-rhel9
Fix deferred
External Secrets Operator for Red Hat OpenShift
external-secrets-operator/external-secrets-operator-bundle
Fix deferred
External Secrets Operator for Red Hat OpenShift
external-secrets-operator/external-secrets-operator-rhel9
Fix deferred
External Secrets Operator for Red Hat OpenShift
external-secrets-operator/external-secrets-rhel9
Fix deferred
Gatekeeper 3
gatekeeper/gatekeeper-rhel9
Fix deferred
Logging Subsystem for Red Hat OpenShift
openshift-logging/logging-loki-rhel9
Fix deferred
Logging Subsystem for Red Hat OpenShift
openshift-logging/logging-loki-rhel9
Fix deferred
Logging Subsystem for Red Hat OpenShift
openshift-logging/loki-operator-bundle
Fix deferred
Logging Subsystem for Red Hat OpenShift
openshift-logging/loki-operator-bundle
Fix deferred
Logging Subsystem for Red Hat OpenShift
openshift-logging/loki-rhel9-operator
Fix deferred
Logging Subsystem for Red Hat OpenShift
openshift-logging/loki-rhel9-operator
Fix deferred
Logging Subsystem for Red Hat OpenShift
openshift-logging/lokistack-gateway-rhel9
Fix deferred
Logging Subsystem for Red Hat OpenShift
openshift-logging/lokistack-gateway-rhel9
Fix deferred
Logging Subsystem for Red Hat OpenShift
openshift-logging/opa-openshift-rhel9
Fix deferred
Logging Subsystem for Red Hat OpenShift
openshift-logging/opa-openshift-rhel9
Fix deferred
Multicluster Engine for Kubernetes
multicluster-engine/assisted-image-service-rhel8
Fix deferred
Multicluster Engine for Kubernetes
multicluster-engine/assisted-image-service-rhel9
Fix deferred
Multicluster Engine for Kubernetes
multicluster-engine/managedcluster-import-controller-rhel9
Fix deferred
OpenShift Pipelines
openshift-pipelines-client
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-chains-controller-rhel8
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-chains-controller-rhel9
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-cli-tkn-rhel8
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-cli-tkn-rhel9
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-hub-api-rhel8
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-hub-api-rhel9
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-hub-db-migration-rhel8
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-hub-ui-rhel8
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-opc-rhel9
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-operator-bundle
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-operator-proxy-rhel8
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-operator-webhook-rhel8
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-rhel8-operator
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-rhel9-operator
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-plugin-event-sender-rhel9
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/observatorium-rhel9
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/volsync-operator-bundle
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/volsync-rhel9
Fix deferred
Red Hat Advanced Cluster Security 4
advanced-cluster-security/rhacs-main-rhel8
Fix deferred
Red Hat Advanced Cluster Security 4
advanced-cluster-security/rhacs-rhel8-operator
Fix deferred
Red Hat Advanced Cluster Security 4
advanced-cluster-security/rhacs-roxctl-rhel8
Fix deferred
Red Hat Advanced Cluster Security 4
advanced-cluster-security/rhacs-scanner-v4-rhel8
Fix deferred
Red Hat Edge Manager 1
flightctl
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-alert-exporter-rhel9
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-alertmanager-proxy-rhel9
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-api-rhel9
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-cli-artifacts-rhel9
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-db-setup-rhel9
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-pam-issuer-rhel9
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-periodic-rhel9
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-telemetry-gateway-rhel9
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-ui-ocp-rhel9
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-ui-rhel9
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-userinfo-proxy-rhel9
Fix deferred
Red Hat Edge Manager 1
rhem/flightctl-worker-rhel9
Fix deferred
Red Hat Enterprise Linux 8
osbuild-composer
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-model-registry-rhel9
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-model-registry-rhel8
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-model-registry-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
cri-o
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/oc-mirror-plugin-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-csi-driver-manila-rhel8
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-csi-driver-manila-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-openstack-cinder-csi-driver-rhel8
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-openstack-cinder-csi-driver-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-openstack-cloud-controller-manager-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-telemeter-rhel9
Fix deferred
Red Hat OpenShift distributed tracing 3
rhosdt/tempo-gateway-opa-rhel8
Fix deferred
Red Hat OpenShift distributed tracing 3
rhosdt/tempo-gateway-rhel8
Fix deferred
Red Hat Quay 3
quay/quay-rhel8
Fix deferred
Red Hat Quay 3
quay/quay-rhel9
Fix deferred
Red Hat Satellite 6
satellite/iop-ingress-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/client-server-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/cosign-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/gitsign-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/policy-controller-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/rekor-backfill-redis-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/rekor-cli-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/rekor-monitor-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/rekor-server-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/rhtas-console-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/timestamp-authority-rhel9
Fix deferred
Security Profiles Operator
compliance/openshift-security-profiles-operator-bundle
Fix deferred
Security Profiles Operator
compliance/openshift-security-profiles-rhel8-operator
Fix deferred
Security Profiles Operator
compliance/openshift-selinuxd-rhel8
Fix deferred
Security Profiles Operator
compliance/openshift-selinuxd-rhel9
Fix deferred
Zero Trust Workload Identity Manager
zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9
Fix deferred
Zero Trust Workload Identity Manager
zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9
Fix deferred
Zero Trust Workload Identity Manager
zero-trust-workload-identity-manager/spiffe-spire-server-rhel9
Fix deferred
Zero Trust Workload Identity Manager - Tech Preview
zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9
Fix deferred
Zero Trust Workload Identity Manager - Tech Preview
zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9
Fix deferred
Zero Trust Workload Identity Manager - Tech Preview
zero-trust-workload-identity-manager/spiffe-spire-server-rhel9
Fix deferred
Zero Trust Workload Identity Manager - Tech Preview
zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-operator-bundle
Fix deferred
Zero Trust Workload Identity Manager - Tech Preview
zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/bitwarden-sdk-server-rhel9 | Fix deferred | n/a |
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/external-secrets-operator-bundle | Fix deferred | n/a |
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/external-secrets-operator-rhel9 | Fix deferred | n/a |
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/external-secrets-rhel9 | Fix deferred | n/a |
| Gatekeeper 3 | gatekeeper/gatekeeper-rhel9 | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | openshift-logging/logging-loki-rhel9 | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | openshift-logging/logging-loki-rhel9 | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | openshift-logging/loki-operator-bundle | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | openshift-logging/loki-operator-bundle | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | openshift-logging/loki-rhel9-operator | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | openshift-logging/loki-rhel9-operator | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | openshift-logging/lokistack-gateway-rhel9 | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | openshift-logging/lokistack-gateway-rhel9 | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | openshift-logging/opa-openshift-rhel9 | Fix deferred | n/a |
| Logging Subsystem for Red Hat OpenShift | openshift-logging/opa-openshift-rhel9 | Fix deferred | n/a |
| Multicluster Engine for Kubernetes | multicluster-engine/assisted-image-service-rhel8 | Fix deferred | n/a |
| Multicluster Engine for Kubernetes | multicluster-engine/assisted-image-service-rhel9 | Fix deferred | n/a |
| Multicluster Engine for Kubernetes | multicluster-engine/managedcluster-import-controller-rhel9 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines-client | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-chains-controller-rhel8 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-chains-controller-rhel9 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-cli-tkn-rhel8 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-cli-tkn-rhel9 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-hub-api-rhel8 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-hub-api-rhel9 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-hub-db-migration-rhel8 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-hub-ui-rhel8 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-opc-rhel9 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-operator-bundle | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-operator-proxy-rhel8 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-operator-webhook-rhel8 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-rhel8-operator | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-rhel9-operator | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-plugin-event-sender-rhel9 | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/observatorium-rhel9 | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-operator-bundle | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-rhel9 | Fix deferred | n/a |
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-main-rhel8 | Fix deferred | n/a |
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-rhel8-operator | Fix deferred | n/a |
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-roxctl-rhel8 | Fix deferred | n/a |
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-scanner-v4-rhel8 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | flightctl | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-alert-exporter-rhel9 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-alertmanager-proxy-rhel9 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-api-rhel9 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-cli-artifacts-rhel9 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-db-setup-rhel9 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-pam-issuer-rhel9 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-periodic-rhel9 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-telemetry-gateway-rhel9 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-ui-ocp-rhel9 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-ui-rhel9 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-userinfo-proxy-rhel9 | Fix deferred | n/a |
| Red Hat Edge Manager 1 | rhem/flightctl-worker-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | osbuild-composer | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-model-registry-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-model-registry-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-model-registry-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | cri-o | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/oc-mirror-plugin-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-csi-driver-manila-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-csi-driver-manila-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-openstack-cinder-csi-driver-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-openstack-cinder-csi-driver-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-openstack-cloud-controller-manager-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-telemeter-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift distributed tracing 3 | rhosdt/tempo-gateway-opa-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift distributed tracing 3 | rhosdt/tempo-gateway-rhel8 | Fix deferred | n/a |
| Red Hat Quay 3 | quay/quay-rhel8 | Fix deferred | n/a |
| Red Hat Quay 3 | quay/quay-rhel9 | Fix deferred | n/a |
| Red Hat Satellite 6 | satellite/iop-ingress-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/client-server-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/cosign-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/gitsign-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/policy-controller-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/rekor-backfill-redis-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/rekor-cli-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/rekor-monitor-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/rekor-server-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/rhtas-console-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/timestamp-authority-rhel9 | Fix deferred | n/a |
| Security Profiles Operator | compliance/openshift-security-profiles-operator-bundle | Fix deferred | n/a |
| Security Profiles Operator | compliance/openshift-security-profiles-rhel8-operator | Fix deferred | n/a |
| Security Profiles Operator | compliance/openshift-selinuxd-rhel8 | Fix deferred | n/a |
| Security Profiles Operator | compliance/openshift-selinuxd-rhel9 | Fix deferred | n/a |
| Zero Trust Workload Identity Manager | zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9 | Fix deferred | n/a |
| Zero Trust Workload Identity Manager | zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9 | Fix deferred | n/a |
| Zero Trust Workload Identity Manager | zero-trust-workload-identity-manager/spiffe-spire-server-rhel9 | Fix deferred | n/a |
| Zero Trust Workload Identity Manager - Tech Preview | zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9 | Fix deferred | n/a |
| Zero Trust Workload Identity Manager - Tech Preview | zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9 | Fix deferred | n/a |
| Zero Trust Workload Identity Manager - Tech Preview | zero-trust-workload-identity-manager/spiffe-spire-server-rhel9 | Fix deferred | n/a |
| Zero Trust Workload Identity Manager - Tech Preview | zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-operator-bundle | Fix deferred | n/a |
| Zero Trust Workload Identity Manager - Tech Preview | zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9 | Fix deferred | n/a |
github.com/go-chi/chi/v5
Go
Introduced 5.2.2 Fixed 5.2.4github.com/go-chi/chi
Go
Introduced 0 Fixed not fixedgithub.com/go-chi/chi/v2
Go
Introduced 0 Fixed not fixedgithub.com/go-chi/chi/v3
Go
Introduced 0 Fixed not fixedgithub.com/go-chi/chi/v4
Go
Introduced 0 Fixed not fixed
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/go-chi/chi/v5 | 5.2.2 | 5.2.4 |
| Go | github.com/go-chi/chi | 0 | not fixed |
| Go | github.com/go-chi/chi/v2 | 0 | not fixed |
| Go | github.com/go-chi/chi/v3 | 0 | not fixed |
| Go | github.com/go-chi/chi/v4 | 0 | not fixed |
Remediation
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (10)
- http://go-chichi.com
- https://access.redhat.com/security/cve/CVE-2025-69725 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2441027 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-207653 Advisory
- https://github.com/advisories/GHSA-mqqf-5wvp-8fh8 Advisory
- https://github.com/go-chi/chi/commit/6eb35881c0e438ffb663ddbad3a61babaa5e5d8a
- https://github.com/go-chi/chi/issues/1037
- https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8
- https://nvd.nist.gov/vuln/detail/CVE-2025-69725
- https://www.cve.org/CVERecord?id=CVE-2025-69725
Change history (0)
No recorded changes yet.