CVE catalog

CVE-2026-114437

golang-github-go-chi-chi: CVE-2026-114437

[CVE catalog]

Severity
Medium · CVSS 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.13% · Oct 25, 2026

In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-go-chi-chisid5.3.0-1vulnerable
Debiangolang-github-go-chi-chiforky5.3.0-1vulnerable
Debiangolang-github-go-chi-chitrixie5.2.0-1vulnerable
Debiangolang-github-go-chi-chibookworm5.0.7-1vulnerable
Ubuntugolang-github-go-chi-chi22.041.5.1-2vulnerable
Ubuntugolang-github-go-chi-chi22.045.0.7-1vulnerable
Ubuntugolang-github-go-chi-chi24.045.0.7-1vulnerable
Ubuntugolang-github-go-chi-chi26.105.2.3-1vulnerable
Ubuntugolang-github-go-chi-chi26.105.3.0-1vulnerable
Ubuntugolang-github-go-chi-chi26.045.2.0-1vulnerable
Ubuntugolang-github-go-chi-chi26.045.2.3-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-go-chi-chisourcesid(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-go-chi-chisourceforky(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-go-chi-chisourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-go-chi-chisourcebookworm(unfixed)not yet assignedNot reportedNot reported

Notes

[trixie] golang-github-go-chi-chi: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-go-chi-chi-dev]Affected

    Source package: [golang-github-go-chi-chi]

    Details (2)

    • 5.0.7-1 · all · bookworm

      Affected

      dsa · golang-github-go-chi-chi · debian · bookworm; dsa · golang-github-go-chi-chi · debian · 12

    • 5.0.7-1 · all · bookworm

      Affected

      dsa · golang-github-go-chi-chi · debian · bookworm; dsa · golang-github-go-chi-chi · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]