CVE-2026-71271

Name of the Vulnerable Software and Affected Versions Memos (affected versions not specified)

Description Insufficient validation of webhook URLs occurs in the isReservedIP() function located in internal/webhook/validate.go. The function checks candidate IPs against a reserved CIDR list but omits the 0.0.0.0/8 range and fails to call ip.IsUnspecified(). Since Linux redirects connections to 0.0.0.0 to the loopback interface (127.0.0.1), an attacker can register a webhook URL such as 'http://0.0.0.0:PORT/' to bypass reserved-IP checks. This allows the server to make outbound HTTP requests to its own loopback interface, potentially exposing internal-only services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.