CVE-2026-114437
Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For
Reported by tenable · Published October 21, 2026
github.com/go-chi/chi/v5 is fixed in 5.4.0 (Go Modules)
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/go-chi/chi/v5 | Go Modules | 5.4.0 |
| redpanda-console-3.11 | Chainguard | 3.11.0-r11 |
| step-ca | Wolfi | 0.30.2-r29 |
| crossplane-fips-2.4 | Chainguard | 2.4.3-r1 |
| cloudflared | Chainguard | 2026.10.3-r1 |
| sftpgo | Wolfi | 2.7.6-r4 |
| ratify-fips | Chainguard | 1.4.8-r1 |
| sloth-fips | Chainguard | 0.16.0-r3 |
| telegraf-1.38 | Wolfi | 1.38.4-r36 |
| fleet-server-9.2 | Chainguard | 9.2.8-r20 |
| tekton-chains | Chainguard | 0.29.9-r1 |
| coder-fips-2.32 | Chainguard | 2.32.10-r17 |
87 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| go-chi | chi | 0 |
| chainguard | redpanda-console-3.11 | 0 |
| wolfi | step-ca | 0 |
| chainguard | crossplane-fips-2.4 | 0 |
| chainguard | cloudflared | 0 |
| wolfi | sftpgo | 0 |
| chainguard | ratify-fips | 0 |
| chainguard | sloth-fips | 0 |
| wolfi | telegraf-1.38 | 0 |
| chainguard | fleet-server-9.2 | 0 |
| chainguard | tekton-chains | 0 |
| chainguard | coder-fips-2.32 | 0 |
| wolfi | kyverno-1.18 | 0 |
| chainguard | zot | 0 |
| chainguard | chainctl-fips | 0 |
| chainguard | gitea | 0 |
| chainguard | teleport-18 | 0 |
| wolfi | neuvector-sigstore-interface | 0 |
| wolfi | gitea | 0 |
| chainguard | omni-fips | 0 |
…and 158 more
Timeline
- Oct 21, 2026 CVE Published
- Oct 21, 2026 CVE Updated
- Oct 22, 2026 EPSS Score (2 in total, the first dated here)
- Oct 22, 2026 Coalition ESS Score
- Oct 30, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-114437
vulnetix vdb fixes CVE-2026-114437Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-114437/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart