CVE-2025-71405: 
Datadog Agent vulnerability analysis and mitigation

CVE-2025-71405 is a Host Header Injection leading to Open Redirect vulnerability in the RedirectSlashes middleware of the go-chi/chi Go HTTP router framework. All chi versions before v5.2.2 are affected; v5.2.2 is the patched release. The vulnerability was disclosed on June 20, 2025 (GHSA published) and added to NVD on August 14, 2026. It carries a CVSS v4.0 base score of 5.1 (Medium), assigned by VulnCheck (GitHub Advisory, GitHub Advisory DB).

The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect). The RedirectSlashes function in middleware/strip.go constructs the redirect URL using the HTTP Host header directly (at line 55 of the source file) without validating that the header value matches the application's expected host. An unauthenticated attacker can send an HTTP request with a crafted Host header (e.g., Host: attacker.com) to any path that triggers the RedirectSlashes middleware, causing the server to issue a redirect response pointing to the attacker-controlled domain. Exploitation requires no privileges but does require active user interaction (the victim must follow the redirect), and notably cannot be triggered from standard browsers or email clients without explicit Host header manipulation — limiting its practical attack surface to scenarios such as server-side request forgery chains or misconfigured proxies (GitHub Advisory).

Successful exploitation allows an attacker to redirect users from a trusted application domain to an arbitrary attacker-controlled host, enabling phishing attacks, credential harvesting, and potential malware distribution. The confidentiality and integrity of the vulnerable system are partially impacted (low), while availability is unaffected. There is no direct system compromise or lateral movement risk, but the social engineering potential is significant when users trust the originating application's domain (GitHub Advisory, GitHub Advisory DB).

A proof-of-concept (PoC) is publicly documented in the GitHub security advisory, demonstrating exploitation via curl with a crafted Host header. CISA's SSVC assessment classifies exploitation as "poc" with non-automatable, partial technical impact. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.307% (23rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, GitHub Advisory DB).

1. Identify target: Locate a web application built with go-chi/chi versions before v5.2.2 that uses the RedirectSlashes middleware (e.g., via source code review, dependency scanning, or HTTP response fingerprinting).
2. Identify a triggering path: Find any URL path ending with a trailing slash (or lacking one, depending on middleware configuration) that would cause RedirectSlashes to issue a redirect — for example, http://target.com/somepath/.
3. Craft the malicious request: Send an HTTP request to the target with a forged Host header pointing to an attacker-controlled domain:

   curl -iL -H "Host: attacker.com" http://target.com/somepath/

4. Observe redirect: The server responds with a 301/302 redirect to http://attacker.com/somepath (or similar), constructed using the attacker-supplied Host header value.
5. Deliver to victim: Craft a scenario (e.g., via a misconfigured reverse proxy, SSRF, or social engineering) where the victim's HTTP client follows the redirect to the attacker-controlled host, landing on a phishing page designed to steal credentials or deliver malware (GitHub Advisory).

• Network: HTTP requests to application endpoints with Host header values that do not match the application's configured domain; redirect responses (301/302) pointing to external or unexpected domains originating from the chi application server.
• Logs: Web server or application access logs showing requests with anomalous Host header values (e.g., Host: attacker.com) against paths handled by RedirectSlashes middleware; Location response headers in logs pointing to external domains not owned by the organization.
• Application Behavior: Unexpected outbound redirect chains from the application to third-party domains, particularly following requests to paths with trailing slashes.

Upgrade go-chi/chi to version v5.2.2 or later, which resolves the issue by using r.RequestURI instead of r.Host to construct redirect URLs in the RedirectSlashes middleware. As a workaround for deployments that cannot immediately upgrade, implement Host header validation at the reverse proxy or application layer to ensure only expected hostnames are accepted. Additionally, consider adding HTTP Strict-Transport-Security (HSTS) headers and reviewing application logs for suspicious redirect patterns (GitHub Advisory, GitHub Advisory DB).

The vulnerability was reported by security researcher anuraagbaishya and published by go-chi maintainer VojtechVitek via GitHub's security advisory process. The advisory notes this is considered lower-severity because exploitation requires Host header manipulation, which is not possible from standard browsers or email clients. No significant broader media coverage or notable community debate has been identified beyond the advisory itself (GitHub Advisory).