What is CVE-2026-71272?
The safeDialContext() webhook dispatch function in Memos resolves a hostname to an IP, validates it against reserved ranges, but then dials using the original hostname instead of the validated IP. This may allow SSRF attacks; users should update Memos to the latest version.
Azərbaycanca: CVE-2026-71272: Memos platformasında webhook göndərmə funksiyası safeDialContext() host adını IP ünvanına çevirib təhlükəsizlik yoxlaması keçirsə də, daha sonra yoxlanılmış IP əvəzinə orijinal host adı ilə əlaqə qurur. Bu, SSRF (Server-Side Request Forgery) hücumlarına yol aça bilər; istifadəçilər Memos-u ən son versiyaya yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-918; shared vendor: Memos
FAQ2
What security issue can CVE-2026-71272 cause in the Memos platform?
CVE-2026-71272 may allow Server-Side Request Forgery (SSRF) attacks because the safeDialContext() function resolves a hostname to an IP, validates it, but then dials using the original hostname instead of the validated IP.
What should Memos users do to protect against CVE-2026-71272?
Memos users should update the platform to the latest version to protect against CVE-2026-71272.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.