{"id":"CVE-2026-114437","published":"2026-10-21T14:17:14.690","lastModified":"2026-10-21T18:17:27.563","description":"In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.\n\nThis issue affects chi before 5.4.0.","cvssScore":4.8,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-348"],"vendors":[],"products":[],"references":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3","tags":[]},{"url":"https://www.tenable.com/security/research/tra-2026-66","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3","tags":[]}],"hasPoc":true,"ai":null}