chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

影響: go:github.com/go-chi/chi/v5 <= 5.3.2 → 5.4.0

ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protect…

Read on GitHub Advisory Database

On 10/24/2026, 05:56 AM, GitHub Advisory Database published "chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For" (type: Advisory). Severity is "Medium" (medium). Related technologies: Go, GitHub. CVE: CVE-2026-114437.