github.com/go-chi/chi/middleware: go-chi/chi: IP spoofing via X-Forwarded-For header manipulation

A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For...

github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

CVE-2026-73212

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 T...

Security Bulletin: IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall (CVE-2026-7366)

Summary IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall CVE-2026-7366 Vulnerability Details CVEID:CVE-2026-7366 DESCRIPTION: IBM DataPower Gateway allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP heade...

github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

github.com/go-chi/chi/middleware: go-chi/chi: IP spoofing via X-Forwarded-For header manipulation

A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For...

github.com/go-chi/chi: go-chi/chi: IP Spoofing via RealIP Middleware allows bypassing access controls

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...

github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

github.com/go-chi/chi: go-chi/chi: IP Spoofing via RealIP Middleware allows bypassing access controls

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...

github.com/go-chi/chi/middleware: go-chi/chi: IP spoofing via X-Forwarded-For header manipulation

A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For...

CVE-2026-25552 Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

EUVD-2026-51595

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

CVE-2026-11870

The CVE concerns the WordPress plugin WP Ghost (Hide My WP Ghost) before version 7.0.05. A vulnerability exists where the plugin does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, enabling unauthenticated attackers to spoof th...

GO-2026-5777 Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi...

GO-2026-5775 Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi...

Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AFUNIX Address in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-haproxy | | Component |...

GHSA-WH89-7897-X99H Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AFUNIX Address in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-haproxy | | Component |...

CVE-2026-64797

Summary (CVE-2026-64797) : A Joomla extension (IP Login by regularlabs.com) is vulnerable to IP spoofing through forwarded client-IP headers without a configured trusted proxy. The underlying issue is trust in forwarded headers, allowing an attacker to spoof the login IP and potentially impersona...

CVE-2026-63770

The CVE concerns Glance 0.8.5, where the authentication handler is vulnerable to IP address spoofing via the X-Forwarded-For header when the server proxied option is enabled. Attackers can alter the leftmost IP in the header to skew per-IP login counters, bypassing brute-force lockout protections...