The Golang Chi web framework’s ClientIPFromXFF middleware allows an attacker who can connect directly to the Go server to insert a trusted‑looking proxy address into the X‑Forwarded‑For header, causing the middleware to report that address as the client IP. This flaw stems from an oversight where the remote TCP peer is not validated against the configured trusted CIDR, enabling IP spoofing that can subvert IP‑based access controls, logging, rate limiting, and audit trails. The weakness is classified as CWE‑346 and CWE‑348.

All releases of the go‑chi:chi library before version 5.4.0 are affected, because the vulnerability originates in the ClientIPFromXFF middleware code prior to that patch level.

The vulnerability carries a CVSS score of 6.3, indicating moderate severity. An EPSS score of < 1% indicates a low probability of exploitation, and it is not listed in the CISA KEV catalog. The required attack vector demands network connectivity to the server; once established, manipulating the X‑Forwarded‑For header is straightforward. This flaw enables an attacker to override the reported client IP, potentially bypassing IP‑based controls or compromising audit information.