CVE-2025-69725: 
Datadog Agent vulnerability analysis and mitigation

CVE-2025-69725 is an Open Redirect vulnerability in the go-chi/chi HTTP router library affecting the RedirectSlashes middleware function. It allows remote, unauthenticated attackers to redirect victim users from a legitimate website domain to an attacker-controlled malicious site. The vulnerability affects go-chi/chi versions >= 5.2.2 and was patched in version 5.2.4. It was published on February 19, 2026, with the underlying security advisory (GHSA-mqqf-5wvp-8fh8) published by the maintainer on January 14, 2026. The CVSS v3.1 base score is 4.7 (Medium) (GitHub Advisory).

The root cause is improper input validation in the RedirectSlashes function within middleware/strip.go (CWE-601: URL Redirection to Untrusted Site). The function trims all leading and trailing forward slashes (/) and prepends a single / to the path (line 52), but critically does not trim or sanitize backslash (\) characters. Additionally, from version 5.2.2 onward, the function no longer includes the Host header in redirect responses (a change made to address a prior vulnerability, GHSA-vrw8-fxc6-2r93). This combination means a request to a path like /\evil.com/ results in a 301 Moved Permanently response with Location: /\evil.com. Most major browsers (Chrome, Firefox) interpret /\evil.com as the protocol-relative URL //evil.com, triggering a redirect to the attacker's domain. A minimal proof-of-concept is included in the official advisory (GitHub Advisory).

Successful exploitation allows an attacker to silently redirect users from a trusted domain to an arbitrary attacker-controlled website, leveraging the reputation of the legitimate site. This can facilitate credential theft via phishing pages, malware delivery, and significant reputational or business damage to the affected organization. The vulnerability has no direct impact on server-side confidentiality, integrity, or availability, but poses a meaningful risk to end users who trust the originating domain. Safari users are not affected due to differing URL parsing behavior (GitHub Advisory).

A working proof-of-concept is publicly available in the official GitHub Security Advisory, demonstrating exploitation via a simple curl request or crafted URL. No authentication or prior knowledge of the application is required. The vulnerability is exploitable against users of Chrome and Firefox but not Safari. The EPSS score is approximately 0.035% (0.000350), indicating low current probability of widespread exploitation. There is no evidence of in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing at this time (GitHub Advisory, Feedly).

1. Identify target: Locate a web application using go-chi/chi >= 5.2.2 with the middleware.RedirectSlashes middleware enabled.
2. Craft malicious URL: Construct a URL targeting the legitimate application domain with a backslash-prefixed attacker domain as the path, e.g., https://legitimate-site.com/\evil.com/ (URL-encoded: https://legitimate-site.com/%5Cevil.com/).
3. Trigger redirect: When a victim visits the crafted URL, the RedirectSlashes middleware processes the path and issues a 301 Moved Permanently response with Location: /\evil.com.
4. Browser interpretation: Chrome or Firefox interprets /\evil.com as the protocol-relative URL //evil.com and redirects the user to https://evil.com (or http://evil.com).
5. Achieve objective: The victim lands on the attacker-controlled site, which may host a phishing page mimicking the legitimate site to harvest credentials, or deliver malware (GitHub Advisory).

• Network: HTTP requests to application paths containing backslash characters (e.g., GET /\evil.com/ or GET /%5Cevil.com/) in web server access logs.
• Logs: 301 Moved Permanently responses where the Location header contains /\ followed by an external domain (e.g., Location: /\evil.com).
• Logs: Unusual referrer headers in downstream logs showing traffic originating from the legitimate application domain but landing on unrelated external sites.

Upgrade go-chi/chi to version 5.2.4 or later, which patches the improper backslash handling in the RedirectSlashes middleware. If an immediate upgrade is not possible, consider disabling the RedirectSlashes middleware as a temporary workaround, or implementing a custom middleware that explicitly sanitizes backslash characters from request paths before processing redirects. Organizations should audit all Go applications using go-chi/chi >= 5.2.2 to determine exposure (GitHub Advisory).

The vulnerability was reported by security researcher thanosgn and published by chi maintainer pkieltyka via GitHub Security Advisory on January 14, 2026. The advisory notes the irony that the vulnerable behavior was introduced as a fix for a prior vulnerability (GHSA-vrw8-fxc6-2r93), highlighting the challenge of balancing security trade-offs in middleware design. Downstream Linux distributions including openSUSE and Fedora have issued security updates for packages bundling affected versions of go-chi/chi (e.g., Trivy, rclone, chezmoi) (GitHub Advisory, openSUSE Security).