{"id":"CVE-2026-71272","published":"2026-08-05T13:24:51.573","lastModified":"2026-08-10T12:17:29.693","description":"Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP address.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-367"],"vendors":[],"products":[],"references":[{"url":"https://github.com/usememos/memos","tags":[]},{"url":"https://github.com/usememos/memos/blob/main/internal/webhook/webhook.go","tags":[]}],"exploitRefs":[{"url":"https://github.com/usememos/memos","tags":[]},{"url":"https://github.com/usememos/memos/blob/main/internal/webhook/webhook.go","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw lies in the safeDialContext function of Memos' webhook dispatch, which fails to use validated IP addresses for network connections, potentially allowing attackers to exploit DNS resolution to execute unauthorized actions.","exploitability":"Exploitation is moderately hard as it requires control over DNS resolution, but preconditions include network access and knowledge of the target's internal IP ranges.","blast_radius":"If exploited, the impact could be significant, as it allows attackers to bypass IP validation and potentially execute arbitrary code or perform unauthorized actions.","remediation":"Disable the affected webhook feature or ensure that only trusted DNS resolvers are used, and update to the latest version of Memos if a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","network","dns","security"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:49:45.774Z"}}