Chi - Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Medium

Synopsis

In Golang Chi web framework, the ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR.

A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.

Solution

Upgrade to Chi version 5.4.0 or later.

Additional References

https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3

Disclosure Timeline

October 06, 2026 : Reported through Github
October 12, 2026 : Tenable asking for update
October 12, 2026 : Vendor acknowledge
October 12, 2026 : The vendor asked to review the fix in PR #1214
October 12, 2026: Tenable confirm the fix
October 12, 2026: The vendor has released version 5.4.0 containing the fix

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]