CVE-2026-114437 go-chi CVE debrief

Who should care

Defenders of applications using the `chi` package, specifically those using `ClientIPFromXFF` and making the origin server reachable by anonymous clients outside the configured trusted-proxy CIDRs, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-114437 is a remote client IP spoofing vulnerability in the Go `chi` package's `ClientIPFromXFF` function via the `X-Forwarded-For` header. Defenders should prioritize verifying the use of `ClientIPFromXFF` and ensuring the origin server is not reachable by anonymous clients outside the configured trusted-proxy CIDRs.

• An attacker can change security decisions and expose a protected handler within the same application.
• The attack requires one unauthenticated HTTP request with no user interaction.
• No availability loss was observed.

Technical summary

The `ClientIPFromXFF` function in the Go `chi` package skips any `X-Forwarded-For` entry in a configured trusted CIDR but never verifies that the direct TCP peer in `http.Request.RemoteAddr` belongs to that CIDR. This allows a client that can reach the Go server directly to append a trusted-looking proxy address and choose the client IP returned by `middleware.GetClientIP`. The vulnerability allows an attacker to change security decisions and expose a protected handler within the same application. Defenders should prioritize verifying the use of `ClientIPFromXFF` and ensuring the origin server is not reachable by anonymous clients outside the configured trusted-proxy CIDRs.

Defensive priority

Defenders should prioritize verifying the use of `ClientIPFromXFF` and ensuring the origin server is not reachable by anonymous clients outside the configured trusted-proxy CIDRs.

Recommended defensive actions

• Verify the use of `ClientIPFromXFF` in the application and ensure the origin server is not reachable by anonymous clients outside the configured trusted-proxy CIDRs.
• Update to version 5.4.0 or later of the `github.com/go-chi/chi/v5` package.
• Monitor for unusual traffic patterns or security decision changes within the application.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability allows an attacker to append a trusted-looking proxy address and choose the client IP returned by `middleware.GetClientIP`. This requires one unauthenticated HTTP request with no user interaction.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.