DNS Rebinding Bypass Vulnerability in Memos Webhook Functionality

CVE-2026-71272

What is CVE-2026-71272?

The webhook dispatch function in Memos contains a vulnerability where the target hostname is resolved but retains potential exposure to DNS rebinding attacks. Specifically, while validating incoming IP addresses against reserved ranges, the original hostname is used for further operations instead of the validated IP. This flaw enables an attacker with control over the DNS of the webhook's hostname to exploit the timing between validation and the actual use of DNS resolution. The result is a potential circumvention of server-side request forgery (SSRF) protections, allowing unauthorized access to internal resources.

References