CVE-2026-114437 Details
Description
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.
A vulnerability exists in the Golang Chi web framework in versions prior to 5.4.0, specifically within the ClientIPFromXFF middleware. This issue arises because the middleware fails to verify that the direct TCP peer, as indicated by http.Request.RemoteAddr, belongs to a trusted CIDR. As a result, a client with direct access to the Go server can manipulate the X-Forwarded-For header to include a trusted-looking proxy address, thereby selecting the client IP that middleware.GetClientIP returns. The vulnerability allows for unauthorized access to protected handlers by spoofing the client IP.
Upgrade to Golang Chi version 5.4.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3 | [email protected] | AdvisoryExploitRemedy |
| https://www.tenable.com/security/research/tra-2026-66 | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-348 | Use of Less Trusted Source | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Golang Chi | <= 5.3.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |