Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2026-71271

Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

Description

Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/html_meta.go, which does.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

usememos memos

Default version status: unaffected

  • 0 to ≤ 0.29.1affected

References