StackRadar

CVE-2026-114437

Medium

Advisory

Published 23 Oct 2026In the index since 24 Oct 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.001
2nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
307
of 18,232 indexed, latest versions
Container images
274
deployed by those charts
Fix available
1 of 1
affected package

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Carried by container images the latest versions of 307 of 18,232 indexed charts deploy, on 274 images.

Affected packageAffected versionsFixed inImages
github.com/go-chi/chi/v5golangv5.0.0, v5.0.2, v5.0.3, v5.0.7+15 more5.4.0274
OSV records
GHSA-j6qf-3m9c-vwj3

Charts affected

307 by stars
ChartLatestAffected imagesRadar Score
artifact-hubartifact-hubVerified publisher1.23.03 of 7See more

artifact-hub artifact-hub 1.23.0

3 of the 7 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
aquasec/trivy:0.69.3bcc376de8d77
github.com/go-chi/chi/v5@v5.2.4
5.4.0
artifacthub/hub:v1.23.07d3a91c539dc
github.com/go-chi/chi/v5@v5.3.0
5.4.0
artifacthub/scanner:v1.23.02d8365601f0e
github.com/go-chi/chi/v5@v5.2.4
5.4.0

Open the chart page →

15,411
uptime-kumauptime-kumaVerified publisher4.2.01 of 1See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
github.com/go-chi/chi/v5@v5.2.2
5.4.0

Open the chart page →

42,586
falcofalcosecurity9.2.12 of 3See more

falco falcosecurity 9.2.1

2 of the 3 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
falcosecurity/falco-driver-loader:0.45.16cfd7418907e
github.com/go-chi/chi/v5@v5.3.0
5.4.0
falcosecurity/falcoctl:0.14.290ba9627886e
github.com/go-chi/chi/v5@v5.3.0
5.4.0

Open the chart page →

18,043
kubeviewkubeviewVerified publisher2.2.11 of 1See more

kubeview kubeview 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/benc-uk/kubeview:latest45b64d7c7016
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

414
flux2fluxcd-community2.19.11 of 7See more

flux2 fluxcd-community 2.19.1

1 of the 7 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/source-controller:v1.9.56f20d232d596
github.com/go-chi/chi/v5@v5.3.0
5.4.0

Open the chart page →

4,765
k10kastenVerified publisher9.0.91 of 23See more

k10 kasten 9.0.9

1 of the 23 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
gcr.io/kasten-images/gateway:9.0.975609642e202
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

1,471
mariadb-operatormariadb-operator26.10.11 of 1See more

mariadb-operator mariadb-operator 26.10.1

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/mariadb-operator/mariadb-operator:26.10.137714fb240a5
github.com/go-chi/chi/v5@v5.2.5
5.4.0

Open the chart page →

602
codercoder-v2OfficialVerified publisher2.38.21 of 1See more

coder coder-v2 2.38.2

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/coder/coder:v2.38.2ab17fc8e172e
github.com/go-chi/chi/v5@v5.3.1
5.4.0

Open the chart page →

199
telegrafinfluxdata1.8.781 of 1See more

telegraf influxdata 1.8.78

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
library/telegraf:1.40-alpined3b22c2bd211
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

250
volsyncbackube-helm-chartsVerified publisher0.16.01 of 1See more

volsync backube-helm-charts 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
quay.io/backube/volsync:0.16.00d03a6aad575
github.com/go-chi/chi/v5@v5.2.5
5.4.0

Open the chart page →

2,014
sftpgosftpgoOfficialVerified publisher0.48.01 of 1See more

sftpgo sftpgo 0.48.0

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/drakkan/sftpgo:v2.7.59011fe608d33
github.com/go-chi/chi/v5@v5.3.1
5.4.0

Open the chart page →

1,799
cloudflaredkubitodevVerified publisher1.7.91 of 1See more

cloudflared kubitodev 1.7.9

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2026.3.06b599ca3e974
github.com/go-chi/chi/v5@v5.2.2
5.4.0

Open the chart page →

2,101
zotzot0.1.1281 of 1See more

zot zot 0.1.128

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/project-zot/zot:v2.1.2296cda11459ce
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

603
localstacklocalstack0.7.11 of 1See more

localstack localstack 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
localstack/localstack:latestaa5632e041ca
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

1,324
karmawiremindVerified publisher2.13.11 of 1See more

karma wiremind 2.13.1

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/prymitive/karma:v0.13190a10c5c6793
github.com/go-chi/chi/v5@v5.2.5
5.4.0

Open the chart page →

398
kubescape-operatorkubescape1.40.51 of 6See more

kubescape-operator kubescape 1.40.5

1 of the 6 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
quay.io/kubescape/kubescape:v4.0.14418fa941ecc0
github.com/go-chi/chi/v5@v5.3.0
5.4.0

Open the chart page →

2,694
s3-proxyoxyno-zetaVerified publisher2.28.01 of 1See more

s3-proxy oxyno-zeta 2.28.0

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
oxynozeta/s3-proxy:5.1.121115040e224
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

467
spirespiffeVerified publisher0.30.31 of 10See more

spire spiffe 0.30.3

1 of the 10 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/spiffe/spire-agent:1.15.341b0dcd8b258
github.com/go-chi/chi/v5@v5.3.0
5.4.0

Open the chart page →

4,153
lakefslakefsVerified publisher1.12.461 of 1See more

lakefs lakefs 1.12.46

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
treeverse/lakefs:1.88.0237a17c6b2d8
github.com/go-chi/chi/v5@v5.2.4
5.4.0

Open the chart page →

578
coreneuvectorchartsVerified publisher2.11.31 of 5See more

core neuvectorcharts 2.11.3

1 of the 5 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
neuvector/scanner:6abb5b6e8be40
github.com/go-chi/chi/v5@v5.3.0
5.4.0

Open the chart page →

615
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
supabase/gotrue:v2.163.0ba4ddc594b0b
github.com/go-chi/chi/v5@v5.0.12
5.4.0

Open the chart page →

91,110
caddyalekcVerified publisher0.9.21 of 1See more

caddy alekc 0.9.2

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
library/caddy:2.11.7-alpined8542f48d34a
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

265
connaisseurconnaisseurVerified publisher2.13.11 of 2See more

connaisseur connaisseur 2.13.1

1 of the 2 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
securesystemsengineering/connaisseur:v3.13.135867d5b4dbb
github.com/go-chi/chi/v5@v5.3.1
5.4.0

Open the chart page →

4,098
gatekeepergogatekeeperVerified publisher0.1.671 of 1See more

gatekeeper gogatekeeper 0.1.67

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
quay.io/gogatekeeper/gatekeeper:5.0.11bf649057cce
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

15
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
gitea/gitea:1.22.376f516a1a8c2
github.com/go-chi/chi/v5@v5.0.12
5.4.0

Open the chart page →

28,803
nuclionuclio0.23.102 of 2See more

nuclio nuclio 0.23.10

2 of the 2 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
quay.io/nuclio/controller:1.17.10-amd642ab6589c01c1
github.com/go-chi/chi/v5@v5.3.1
5.4.0
quay.io/nuclio/dashboard:1.17.10-amd64539b498e7ca1
github.com/go-chi/chi/v5@v5.3.1
5.4.0

Open the chart page →

1,671
pyrrarlex0.15.01 of 1See more

pyrra rlex 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/pyrra-dev/pyrra:v0.8.10e02ef538ef0
github.com/go-chi/chi/v5@v5.1.0
5.4.0

Open the chart page →

1,542
codercoderOfficialVerified publisher1.44.61 of 2See more

coder coder 1.44.6

1 of the 2 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
coderenvs/coder-service:1.44.61deffc4670e6
github.com/go-chi/chi/v5@v5.0.7
5.4.0

Open the chart page →

8,213
convoyconvoyVerified publisher3.7.131 of 3See more

convoy convoy 3.7.13

1 of the 3 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
getconvoy/convoy:v26.7.6f4934cc05e31
github.com/go-chi/chi/v5@v5.2.4
5.4.0

Open the chart page →

7,497
cortexcortex3.5.01 of 4See more

cortex cortex 3.5.0

1 of the 4 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
quay.io/cortexproject/cortex:v1.21.18577eb292a01
github.com/go-chi/chi/v5@v5.2.2
5.4.0

Open the chart page →

4,156
selenium-gridselenium-grid0.62.12 of 4See more

selenium-grid selenium-grid 0.62.1

2 of the 4 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
selenium/node-chrome:4.51.0-20261010b3f54a14452e
github.com/go-chi/chi/v5@v5.3.1
5.4.0
selenium/node-firefox:4.51.0-20261010e6a109a147cd
github.com/go-chi/chi/v5@v5.3.1
5.4.0

Open the chart page →

9,001
rekorsigstoreVerified publisher1.8.71 of 9See more

rekor sigstore 1.8.7

1 of the 9 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/sigstore/rekor/rekor-server:v1.5.4100d793d68d0
github.com/go-chi/chi/v5@v5.3.1
5.4.0

Open the chart page →

8,692
cloudflaredartur9010Verified publisher1.0.91 of 3See more

cloudflared artur9010 1.0.9

1 of the 3 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2026.3.06b599ca3e974
github.com/go-chi/chi/v5@v5.2.2
5.4.0

Open the chart page →

4,538
routercosmo-routerOfficialVerified publisher0.18.01 of 1See more

router cosmo-router 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/router:0.243.05afcab98d9d7
github.com/go-chi/chi/v5@v5.2.2
5.4.0

Open the chart page →

2,379
kerberneteskerbernetesVerified publisher1.1.111 of 1See more

kerbernetes kerbernetes 1.1.11

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/froz42/kerbernetes:v1.1.6d5c074be8366
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

432
argo-watchershini4iVerified publisher1.4.11 of 1See more

argo-watcher shini4i 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/shini4i/argo-watcher:v1.4.20faab179997f
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

237
dumpscriptcloudscriptVerified publisher1.11.01 of 1See more

dumpscript cloudscript 1.11.0

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/cloudscript-technology/dumpscript:v0.0.45-alpine-edge99732098a0f3
github.com/go-chi/chi/v5@v5.3.1
5.4.0

Open the chart page →

262
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
github.com/go-chi/chi/v5@v5.0.10
5.4.0

Open the chart page →

79,283
cosmocosmo-platformOfficialVerified publisher0.22.11 of 10See more

cosmo cosmo-platform 0.22.1

1 of the 10 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
github.com/go-chi/chi/v5@v5.0.12
5.4.0

Open the chart page →

94,494
dapr-dashboarddapr0.15.01 of 1See more

dapr-dashboard dapr 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
daprio/dashboard:0.15.04be696707bd1
github.com/go-chi/chi/v5@v5.0.11
5.4.0

Open the chart page →

2,014
hoppscotchdeliveryheroVerified publisher0.3.21 of 1See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
github.com/go-chi/chi/v5@v5.0.10
5.4.0

Open the chart page →

4,493
distrdistrOfficialVerified publisher4.6.11 of 4See more

distr distr 4.6.1

1 of the 4 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
rclone/rclone:1.75.22687085f718d
github.com/go-chi/chi/v5@v5.3.1
5.4.0

Open the chart page →

387
navidromedjjudas21Verified publisher6.8.71 of 1See more

navidrome djjudas21 6.8.7

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
deluan/navidrome:0.64.238dc2727bfcf
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

602
blockygeek-cookbookVerified publisher10.5.21 of 1See more

blocky geek-cookbook 10.5.2

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
ghcr.io/0xerr0r/blocky:v0.18b15824464acb
github.com/go-chi/chi/v5@v5.0.7
5.4.0

Open the chart page →

4,184
giteagroundhog2k0.16.61 of 1See more

gitea groundhog2k 0.16.6

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
gitea/gitea:28.2.030777c91280d
github.com/go-chi/chi/v5@v5.3.2
5.4.0

Open the chart page →

44
haproxyhaproxytechVerified publisher1.30.21 of 1See more

haproxy haproxytech 1.30.2

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
haproxytech/haproxy-alpine:3.4.41fe3f201ebb5
github.com/go-chi/chi/v5@v5.3.1
5.4.0

Open the chart page →

909
frpc-ingressinfinity-server0.4.11 of 1See more

frpc-ingress infinity-server 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
springhack/frpc_ingress:latest4aceb821da88
github.com/go-chi/chi/v5@v5.0.8
5.4.0

Open the chart page →

3,840
karporkusionstackVerified publisher0.7.81 of 3See more

karpor kusionstack 0.7.8

1 of the 3 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
kusionstack/karpor:v0.6.4b707d3bf0abd
github.com/go-chi/chi/v5@v5.0.10
5.4.0

Open the chart page →

4,744
rclonemglants2.3.41 of 1See more

rclone mglants 2.3.4

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
rclone/rclone:1.57.01e6eeabddc01
github.com/go-chi/chi/v5@v5.0.3
5.4.0

Open the chart page →

3,974
pomeriumpomerium34.0.11 of 1See more

pomerium pomerium 34.0.1

1 of the 1 container images this version deploys carry CVE-2026-114437.

Container imageDigestPackageFixed in
pomerium/pomerium:v0.22.19c69b10a2126
github.com/go-chi/chi/v5@v5.0.8
5.4.0

Open the chart page →

2,967

Container images carrying it

274 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
github.com/go-chi/chi/v5@v5.0.12
5.4.0
1
ghcr.io/wundergraph/cosmo/router:0.243.05afcab98d9d7
github.com/go-chi/chi/v5@v5.2.2
5.4.0
1
ghcr.io/wyrihaximusnet/kubernetes-redis-db-assignment-operator:v1.0.831060be60bec
github.com/go-chi/chi/v5@v5.0.7
5.4.0
1
public.ecr.aws/diagrid-dev/diagrid-dashboard:latestf1348a65664a
github.com/go-chi/chi/v5@v5.2.4
5.4.0
1
public.ecr.aws/gravitational/teleport-plugin-email:18.11.722a89e27f771
github.com/go-chi/chi/v5@v5.3.0
5.4.0
1
public.ecr.aws/n8h5y2v5/rad-security/rad-bootstrapper:v1.1.115ca2d500d374
github.com/go-chi/chi/v5@v5.0.10
5.4.0
1
public.ecr.aws/n8h5y2v5/rad-security/rad-bootstrapper:v1.1.35c83931b78908
github.com/go-chi/chi/v5@v5.3.0
5.4.0
1
public.ecr.aws/n8h5y2v5/rad-security/rad-guard:v1.1.4538cfe80c705c
github.com/go-chi/chi/v5@v5.3.0
5.4.0
1
public.ecr.aws/n8h5y2v5/rad-security/rad-guard:v1.1.17a94d2d4aae85
github.com/go-chi/chi/v5@v5.0.10
5.4.0
1
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom:v1.1.7288f0fbbe74c6
github.com/go-chi/chi/v5@v5.3.0
5.4.0
1
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom:v1.1.34e97e0e7a2088
github.com/go-chi/chi/v5@v5.0.10
5.4.0
1
public.ecr.aws/n8h5y2v5/rad-security/rad-sync:v1.1.1514f3dfbc0225
github.com/go-chi/chi/v5@v5.0.10
5.4.0
1
public.ecr.aws/n8h5y2v5/rad-security/rad-sync:v1.1.393a04fd18e463
github.com/go-chi/chi/v5@v5.3.0
5.4.0
1
public.ecr.aws/n8h5y2v5/rad-security/rad-watch:v1.1.5143be72304cb9
github.com/go-chi/chi/v5@v5.3.0
5.4.0
1
public.ecr.aws/n8h5y2v5/rad-security/rad-watch:v1.1.25b9a7d6bc2a0c
github.com/go-chi/chi/v5@v5.0.10
5.4.0
1
public.ecr.aws/perfectscale-io/psc-exporter:v1.0.45-redhat9083e60c38bc
github.com/go-chi/chi/v5@v5.0.10
5.4.0
1
quay.io/backube/volsync:0.16.00d03a6aad575
github.com/go-chi/chi/v5@v5.2.5
5.4.0
1
quay.io/cortexproject/cortex:v1.21.18577eb292a01
github.com/go-chi/chi/v5@v5.2.2
5.4.0
1
quay.io/gogatekeeper/gatekeeper:5.0.11bf649057cce
github.com/go-chi/chi/v5@v5.3.2
5.4.0
1
quay.io/kubescape/kubescape:v4.0.14418fa941ecc0
github.com/go-chi/chi/v5@v5.3.0
5.4.0
1
quay.io/nuclio/controller:1.17.10-amd642ab6589c01c1
github.com/go-chi/chi/v5@v5.3.1
5.4.0
1
quay.io/nuclio/dashboard:1.17.10-amd64539b498e7ca1
github.com/go-chi/chi/v5@v5.3.1
5.4.0
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
github.com/go-chi/chi/v5@v5.2.5
5.4.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
github.com/go-chi/chi/v5@v5.3.0
5.4.0
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.