CVE-2026-45045
Description
A flaw was found in the GoFiber web framework's BalancerForward proxy helper. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Real-IP header. Because the Header.Add() function is used instead of Header.Set(), an attacker-supplied X-Real-IP value is forwarded to upstream servers alongside the legitimate IP. This can lead to bypassing IP-based security controls such as rate limiting, access control lists (ACLs), and geolocation restrictions, and can also poison audit logs.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To prevent IP spoofing via the X-Real-IP header, configure any reverse proxy or load balancer positioned in front of the GoFiber application to explicitly set and overwrite the X-Real-IP header with the actual client IP address, and to strip any X-Real-IP headers provided by the client. For example, in Nginx, use `proxy_set_header X-Real-IP $remote_addr;` and `proxy_hide_header X-Real-IP;`. This ensures that the GoFiber application receives a trusted IP address for security-sensitive operations. A service reload or restart of the proxy may be required for changes to take effect.
Understanding the Weakness (CWE)
Integrity,Non-Repudiation,Access Control
Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
