chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

影響: go:github.com/go-chi/chi/v5 <= 5.3.2 → 5.4.0

ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protect…

GitHub Advisory Databaseで読む

2026/10/24 05:56、GitHub Advisory Databaseが「chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Go、GitHub。CVE: CVE-2026-114437。