CVE-2026-114437

MediumCVSS 4.8/10Last modified Oct 21, 2026

Description

In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.

This issue affects chi before 5.4.0.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-348

Affected software

VendorProductVersions
go-chichi< 5.4.0

References

Timeline

Published
Oct 21, 2026
Last modified
Oct 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1144384.2A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordeCVE-2026-1144397.3A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file adminCVE-2026-1144407.3A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulCVE-2026-1144417.3A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.phCVE-2026-1144573.7A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON reCVE-2026-1144585.9A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rCVE-2026-1144593.7A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside alCVE-2026-114465.3The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of dCVE-2026-1144605.3A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query,CVE-2026-1144626.0Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 beforeCVE-2026-114463The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-CVE-2026-114476.3A security flaw has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function iwinfo_backend of the file iwinfo.so of the c