chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

影響: go:github.com/go-chi/chi/v5 <= 5.3.2 → 5.4.0

ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protect…

GitHub Advisory Database에서 읽기

2026. 10. 24. 오전 05:56, GitHub Advisory Database에서 "chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Go, GitHub. CVE: CVE-2026-114437.