{"id":"GHSA-7cgw-qmxx-7fc2","title":"Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For","summary":"Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For","severity":"medium","cvss":4.8,"cwe":["CWE-348"],"vendor":"go-chi","product":"github.com/go-chi/chi/v5","ecosystem":"go","affected":["github.com/go-chi/chi/v5 <= 5.3.2"],"published":"2026-10-21","updated":"2026-10-23","sourceUpdated":"2026-10-23T20:56:30Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-7cgw-qmxx-7fc2","references":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114437"},{"url":"https://www.tenable.com/security/research/tra-2026-66"},{"url":"https://github.com/advisories/GHSA-7cgw-qmxx-7fc2"}],"tags":["ghsa","go"],"ingestedAt":"2026-10-23T21:38:13.038Z","slug":"GHSA-7cgw-qmxx-7fc2","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-j6qf-3m9c-vwj3. This link is maintained to preserve external references.\n\n## Original Description\nIn the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.\n\nThis issue affects chi before 5.4.0.\n\n## Affected packages\n\n- `github.com/go-chi/chi/v5 <= 5.3.2`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}