## chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

- 種別: advisory
- 重大度: medium
- 関連技術: go, github
- CVE: CVE-2026-114437
- 公開日時: 2026-10-23T20:56:46.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-j6qf-3m9c-vwj3)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-j6qf-3m9c-vwj3

影響: go:github.com/go-chi/chi/v5 <= 5.3.2 → 5.4.0
ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protect…