diff --git a/docs/release-notes.rst b/docs/release-notes.rst
index 22cf5060..f3ed28f2 100644
--- a/docs/release-notes.rst
+++ b/docs/release-notes.rst
@@ -5,6 +5,7 @@ Release Notes
 .. toctree::
    :maxdepth: 2
 
+   release-notes/version-4.6.8.post1
    release-notes/version-4.6.8
    release-notes/version-4.6.7
    release-notes/version-4.6.6
diff --git a/docs/release-notes/version-4.6.8.post1.rst b/docs/release-notes/version-4.6.8.post1.rst
new file mode 100644
index 00000000..61725a6c
--- /dev/null
+++ b/docs/release-notes/version-4.6.8.post1.rst
@@ -0,0 +1,34 @@
+===================
+Version 4.6.8.post1
+===================
+
+Version 4.6.8.post1 is an ActiveState security release of mod_wsgi 4.6.8. It
+contains no functional changes other than the security fix described below.
+
+Note that the ``mod_wsgi.version`` tuple exposed to WSGI applications is
+deliberately left as ``(4, 6, 8)`` so that existing version comparisons keep
+working. Only the version string, as reported in the ``Server`` header and
+used for packaging, becomes ``4.6.8.post1``.
+
+Security Fixes
+--------------
+
+* **CVE-2022-2255** (GHSA-7527-8855-9cf8)
+
+  When using ``WSGITrustedProxies`` and ``WSGITrustedProxyHeaders`` in the
+  Apache configuration, or the ``--trust-proxy`` and ``--trust-proxy-header``
+  options with ``mod_wsgi-express``, if you trusted the ``X-Client-IP``
+  header and a request was received from an untrusted client, the header was
+  not being correctly removed from the set of headers passed through to the
+  WSGI application.
+
+  This only occurred with the ``X-Client-IP`` header; the same problem was
+  not present when trusting the ``X-Real-IP`` or ``X-Forwarded-For`` headers.
+
+  ``REMOTE_ADDR`` was correctly left untouched for untrusted clients, so a
+  WSGI application which follows best practice and reads only ``REMOTE_ADDR``
+  was not affected. An application which additionally enabled WSGI or web
+  framework middleware that re-processes proxy headers could however be
+  induced to trust a client-supplied address.
+
+  This backports the upstream fix released in mod_wsgi 4.9.3.
diff --git a/src/server/mod_wsgi.c b/src/server/mod_wsgi.c
index a2b6153a..4261a08e 100644
--- a/src/server/mod_wsgi.c
+++ b/src/server/mod_wsgi.c
@@ -13942,6 +13942,7 @@ static void wsgi_process_proxy_headers(request_rec *r)
             name = ((const char**)trusted_proxy_headers->elts)[i];
 
             if (!strcmp(name, "HTTP_X_FORWARDED_FOR") ||
+                     !strcmp(name, "HTTP_X_CLIENT_IP") ||
                      !strcmp(name, "HTTP_X_REAL_IP")) {
 
                 match_client_header = 1;
diff --git a/src/server/wsgi_version.h b/src/server/wsgi_version.h
index 5fac22f0..3f0bcee7 100755
--- a/src/server/wsgi_version.h
+++ b/src/server/wsgi_version.h
@@ -26,7 +26,7 @@
 #define MOD_WSGI_MAJORVERSION_NUMBER 4
 #define MOD_WSGI_MINORVERSION_NUMBER 6
 #define MOD_WSGI_MICROVERSION_NUMBER 8
-#define MOD_WSGI_VERSION_STRING "4.6.8"
+#define MOD_WSGI_VERSION_STRING "4.6.8.post1"
 
 /* ------------------------------------------------------------------------- */