CVE-2026-71272: Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()
Memos' webhook dispatch function safeDialContext() (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost() and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP address. Because net.Dialer.DialContext() performs its own independent DNS resolution, an attacker controlling DNS for the webhook's hostname (e.g. via a short TTL) can return a public, allowed IP during validation and a different, internal IP at dial time — a classic time-of-check/time-of-use DNS-rebinding bypass of the SSRF protection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71272?
The severity of CVE-2026-71272 is high with a score of 8.5.
How do I fix CVE-2026-71272?
To fix CVE-2026-71272, update your Memos software to the latest version that addresses this buffer overflow vulnerability.
What systems are affected by CVE-2026-71272?
CVE-2026-71272 affects the Memos Webhook function safeDialContext in Memos software.
What type of vulnerability is CVE-2026-71272?
CVE-2026-71272 is categorized as a Server-Side Request Forgery (SSRF) vulnerability.
What can an attacker do with CVE-2026-71272?
An attacker can exploit CVE-2026-71272 to potentially access internal services by tricking the application into sending requests to unintended endpoints.