{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"5.3.2"}],"component":"github.com/go-chi/chi/v5","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-7cgw-qmxx-7fc2","id":"tcs_01M5NATE0KX022EV1H3KVGEM9Y","modified_at":"2026-10-23T21:15:03.744165797Z","published_at":"2026-10-21T15:42:31Z","references":["https://osv.dev/vulnerability/GHSA-7cgw-qmxx-7fc2","https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3","https://nvd.nist.gov/vuln/detail/CVE-2026-114437","https://www.tenable.com/security/research/tra-2026-66"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-7cgw-qmxx-7fc2","url":"https://osv.dev/vulnerability/GHSA-7cgw-qmxx-7fc2"}],"summary":"Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For"}