Live › vulnerability › GHSA-7cgw-qmxx-7fc2
Go to dashboardThis advisory is withdrawn as a duplicate of GHSA-j6qf-3m9c-vwj3 and describes the chi Go router's ClientIPFromXFF middleware not checking that the direct TCP peer is a trusted proxy. An attacker who can reach the Go server directly can forge the client IP that the middleware returns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/go-chi/chi/v5 | go | <= 5.3.2 | – |
5.3.2 or lower5.4.0 or later, per the descriptionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-j6qf-3m9c-vwj3. This link is maintained to preserve external references.
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.
This issue affects chi before 5.4.0.
This page as .md · .json · in your agent: get_signal("GHSA-7cgw-qmxx-7fc2")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.