{"id":"ghsa-ghsa-j6qf-3m9c-vwj3","seq":661321,"kind":"advisory","title":"chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For","url":"https://github.com/advisories/GHSA-j6qf-3m9c-vwj3","permalink":"https://vulnpulse.app/items/ghsa-ghsa-j6qf-3m9c-vwj3","summary":"影響: go:github.com/go-chi/chi/v5 <= 5.3.2 → 5.4.0\nClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protect…","severity":"medium","techs":["go","github"],"cves":["CVE-2026-114437"],"tags":["GHSA-j6qf-3m9c-vwj3","github.com/go-chi/chi/v5"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:56:46.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}