CVE-2026-114437
MEDIUM
NVD
CVSS Score
4.8
Severity
MEDIUM
Published
Oct 21, 2026
Vendor
unknown
Description
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.