PatchSiren

usememos CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH usememos CVE published 2026-08-05

CVE-2026-71272

The Memos webhook dispatch function safeDialContext() is vulnerable to a time-of-check/time-of-use DNS-rebinding bypass of the SSRF protection. This occurs because the function resolves the target hostname via net.DefaultResolver.LookupHost() and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP [truncated]