Description
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.
This issue affects chi before 5.4.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-chi | chi | < 5.4.0 | 5.4.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-go-chi-chi | No fix yet | — |
| Debian 13 | golang-github-go-chi-chi | No fix yet | — |
| Debian 12 | golang-github-go-chi-chi | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-go-chi-chi | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-go-chi-chi | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-go-chi-chi | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-go-chi-chi | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | hauler | 2.1.2-2.1 | openSUSE-SU-2026:12290-1 |
| openSUSE Leap 16.0 | hauler | 2.1.2-bp160.1.1 | openSUSE-SU-2026:22201-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | caddy | 2.11.7-r6 | — |
| Wolfi rolling | cloudflared | 2026.10.3-r1 | — |
| Wolfi rolling | continuity | 0.11.0-r8 | — |
| Wolfi rolling | cortex | 1.21.1-r20 | — |
| Wolfi rolling | cosign-3 | 3.1.4-r2 | — |
| Wolfi rolling | crossplane-2.2 +1 | 2.2.6-r6 | — |
| Wolfi rolling | dapr-daprd-1.17 | 1.17.18-r1 | — |
| Wolfi rolling | falcoctl | 0.14.2-r6 | — |
| Wolfi rolling | fluxcd-kustomize-mutating-webhook | 0.12.1-r4 | — |
| Wolfi rolling | gitea | 28.2.0-r2 | — |
| Wolfi rolling | github-mcp-server | 2.0.3-r2 | — |
| Wolfi rolling | gitness | 3.3.0-r47 | — |
| Wolfi rolling | gitsign | 0.18.0-r2 | — |
| Wolfi rolling | gogatekeeper | 5.0.1-r2 | — |
| Wolfi rolling | kubescape | 4.0.16-r2 | — |
| Wolfi rolling | kyverno-1.17 +5 | 1.17.2-r42 | — |
| Wolfi rolling | kyverno-1.18 +5 | 1.18.2-r21 | — |
| Wolfi rolling | kyverno-notation-aws | 1.1-r85 | — |
| Wolfi rolling | kyverno-policy-reporter-ui | 2.9.0-r5 | — |
| Wolfi rolling | mariadb-operator | 26.10.2-r1 | — |
| Wolfi rolling | neuvector-sigstore-interface | 4.307-r1 | — |
| Wolfi rolling | policy-controller +1 | 0.15.1-r33 | — |
| Wolfi rolling | ratify | 1.4.8-r1 | — |
| Wolfi rolling | rclone | 1.75.2-r3 | — |
| Wolfi rolling | sftpgo | 2.7.6-r4 | — |
| Wolfi rolling | slsa-verifier | 2.7.1-r38 | — |
| Wolfi rolling | spire-agent | 1.15.5-r1 | — |
| Wolfi rolling | step | 0.31.0-r7 | — |
| Wolfi rolling | step-ca | 0.30.2-r29 | — |
| Wolfi rolling | step-issuer | 0.12.0-r19 | — |
| Wolfi rolling | tekton-chains | 0.29.9-r1 | — |
| Wolfi rolling | telegraf-1.38 | 1.38.4-r36 | — |
| Wolfi rolling | tkn | 0.46.2-r1 | — |
| Wolfi rolling | vexctl | 0.4.4-r14 | — |
| Wolfi rolling | zarf | 0.88.0-r4 | — |
| Wolfi rolling | zot | 2.1.22-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/go-chi/chi/v5 | < 5.4.0 | 5.4.0 | GHSA-j6qf-3m9c-vwj3 |
Advisories 2
- openSUSE-SU-2026:22201-1 Security update for hauler SUSE / openSUSE Security Updates · Nov 1, 2026
- openSUSE-SU-2026:12290-1 hauler-2.1.2-2.1 on GA media SUSE / openSUSE Security Updates · Oct 28, 2026