Bug 2558305 (CVE-2026-114437)

Summary: CVE-2026-114437 github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, anthomas, aos-team-art-private, asdas, dfreiber, dhanak, doconnor, dpaolell, drosa, drow, dsimansk, eborisov, ehelms, gbenhaim, ggainey, gparvin, jbalunas, jburrell, jcantril, jdelft, jpasqual, jsamir, jupierce, juwatts, kaycoth, kingland, lball, lgarciaa, mbiarnes, mdellweg, mhulan, mnovotny, mwringe, ngough, niyer, nmoumoul, osousa, pcreech, ppalepu, ppostler, prdhamdh, rchan, rhaigner, rhel-process-autobot, rochandr, rojacob, sausingh, sdawley, sghai, sidsharm, smallamp, suppawar, tmalecek, tsze, twaugh, veshanka, vkumar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in chi. The ClientIPFromXFF middleware evaluates IP addresses in the X-Forwarded-For (XFF) HTTP header, but fails to verify that the direct incoming network connection originates from a trusted IP address range. A remote attacker who can connect directly to the server can exploit this flaw by supplying a forged proxy address in the header. This allows the attacker to spoof their client IP address, potentially bypassing IP-based access controls and security logging.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2558812, 2558813    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-21 14:03:34 UTC 
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.

This issue affects chi before 5.4.0.