CVE-2026-71272

Name of the Vulnerable Software and Affected Versions Memos (affected versions not specified)

Description The webhook dispatch function safeDialContext() (internal/webhook/webhook.go) resolves the target hostname using net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges. However, it subsequently calls net.JoinHostPort(host, port) using the original hostname instead of the validated IP address. Since net.Dialer.DialContext() performs its own DNS resolution, an attacker controlling the DNS for the webhook's hostname can employ a DNS-rebinding technique. By using a short Time-to-Live (TTL), the attacker can provide a public, allowed IP during the validation phase and a different internal IP during the actual connection phase, bypassing Server-Side Request Forgery (SSRF) protections. DNS-rebinding is a technique used to bypass security controls by changing the DNS record between the time of validation and the time of use.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.