Description (CNA)
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| go-chi / chi | affected 0 before 5.4.0 |
CWE
CWE-348
References
- https://www.tenable.com/security/research/tra-2026-66
- https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3
ADP enrichment
No English description supplied.
No references supplied.