{"id":"GHSA-7cgw-qmxx-7fc2","kind":"vulnerability","aliases":["GHSA-7cgw-qmxx-7fc2"],"related":[],"title":"Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-j6qf-3m9c-vwj3. This link is maintained to preserve external references.\n\n## Original Description\nIn the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.\n\nThis issue affects chi before 5.4.0.","summary":"This advisory is withdrawn as a duplicate of GHSA-j6qf-3m9c-vwj3 and describes the chi Go router's ClientIPFromXFF middleware not checking that the direct TCP peer is a trusted proxy. An attacker who can reach the Go server directly can forge the client IP that the middleware returns.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/go-chi/chi/v5","fixed":[],"affected":"<= 5.3.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["chi","cwe-348","go","package","self-hosted"],"not_affected_if":["behind-trusted-proxy-only","not-using-clientipfromxff"],"how_to_check":"Run go list -m github.com/go-chi/chi/v5 in each Go module and check whether the version is 5.3.2 or lower.\nSearch the code for ClientIPFromXFF or middleware.GetClientIP.","fix":"Upgrade github.com/go-chi/chi/v5 to 5.4.0 or later, per the description.\nFollow GHSA-j6qf-3m9c-vwj3, the canonical advisory, for current guidance.","status":"withdrawn","published_at":"2026-10-21T15:42:31+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:25+00:00","updated_at":"2026-10-23T21:00:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:00:25Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/go-chi/chi/v5 to 5.4.0 or later, per the description.\nFollow GHSA-j6qf-3m9c-vwj3, the canonical advisory, for current guidance.","reach":"internet","impact":"low","summary":"This advisory is withdrawn as a duplicate of GHSA-j6qf-3m9c-vwj3 and describes the chi Go router's ClientIPFromXFF middleware not checking that the direct TCP peer is a trusted proxy. An attacker who can reach the Go server directly can forge the client IP that the middleware returns.","category":"package","who_cares":["go","chi","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker spoofs client IP, bypassing IP-based allowlists or rate limits","analyst_note":"","how_to_check":"Run go list -m github.com/go-chi/chi/v5 in each Go module and check whether the version is 5.3.2 or lower.\nSearch the code for ClientIPFromXFF or middleware.GetClientIP.\nunknown","needs_analyst":false,"not_affected_if":["not-using-clientipfromxff","behind-trusted-proxy-only"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00053,"input_tokens":2982,"output_tokens":463,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-348':28B '/go-chi/chi/v5':25A '3m9c':45B,101C '5.4.0':179C '7cgw':15A,20A '7fc2':17A,22A 'address':165C 'advisori':2A,35B,86C,88C 'affect':176C 'append':159C 'attack':68B 'belong':144C 'check':57B 'chi':3A,26B,50B,116C,177C 'choos':167C 'cidr':133C,147C 'client':4A,79B,149C,169C 'clientipfromxff':8A,54B,120C 'configur':131C 'cwe':27B 'describ':48B 'descript':112C 'direct':60B,75B,139C,156C 'duplic':1A,40B,85C,96C 'entri':128C 'extern':109C 'forg':77B 'forward':12A,126C 'framework':118C 'ghsa':14A,19A,43B,99C 'ghsa-7cgw-qmxx-7fc2':13A,18A 'ghsa-j6qf-3m9c-vwj3':42B,98C 'github.com':24A 'github.com/go-chi/chi/v5':23A 'go':29B,51B,73B,154C 'golang':115C 'host':33B 'http.request.remoteaddr':143C 'ip':5A,80B,170C 'issu':175C 'j6qf':44B,100C 'link':104C 'look':163C 'maintain':106C 'middlewar':55B,83B,121C 'middleware.getclientip':173C 'never':135C 'origin':111C 'packag':30B 'peer':62B,141C 'preserv':108C 'proxi':66B,164C 'qmxx':16A,21A 'reach':71B,152C 'refer':110C 'return':84B,171C 'router':52B 'self':32B 'self-host':31B 'server':74B,155C 'skip':122C 'spoof':6A 'tcp':61B,140C 'therefor':158C 'trust':65B,132C,162C 'trusted-look':161C 'verifi':136C 'via':9A 'vwj3':46B,102C 'web':117C 'withdrawn':37B,91C 'x':11A,125C 'x-forwarded-for':10A,124C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:42:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7cgw-qmxx-7fc2","url":"https://github.com/advisories/GHSA-7cgw-qmxx-7fc2","severity":"medium","published_at":"2026-10-21T15:42:31+00:00","modified_at":"2026-10-23T20:56:30+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}