chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

影響: go:github.com/go-chi/chi/v5 <= 5.3.2 → 5.4.0

ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protect…

在 GitHub Advisory Database 阅读

2026/10/24 05:56，GitHub Advisory Database 发布了“chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Go、GitHub。CVE：CVE-2026-114437。