IP Address Spoofing Vulnerability in Chi Web Framework

CVE-2026-114437

What is CVE-2026-114437?

A security flaw in the Chi web framework allows for potential IP address spoofing due to inadequate verification of the direct TCP peer in the http.Request.RemoteAddr. Specifically, the ClientIPFromXFF middleware improperly handles entries from the X-Forwarded-For header, which can be manipulated by clients directly accessing the Go server. This oversight enables attackers to present a forged, trusted proxy address, ultimately leading to unauthorized access based on misleading client IP information.

References