GHSA-7cgw-qmxx-7fc2

Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Published

2026-10-21

Modified

2026-10-23

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j6qf-3m9c-vwj3. This link is maintained to preserve external references. ## Original Description In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-7cgw-qmxx-7fc2