{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71271", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T12:23:34.967Z", "datePublished": "2026-08-05T12:26:18.502Z", "dateUpdated": "2026-08-05T12:26:18.502Z"}, "containers": {"cna": {"title": "Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass", "descriptions": [{"lang": "en", "value": "Memos' webhook URL validation, isReservedIP() (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified() \u2014 unlike the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go, which does. Because Linux redirects connections to 0.0.0.0 to loopback (127.0.0.1), an attacker registering a webhook URL of http://0.0.0.0:PORT/ bypasses the reserved-IP check and causes the Memos server to make outbound HTTP requests to its own loopback interface, exposing internal-only services."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918", "cweId": "CWE-918", "type": "CWE"}]}], "affected": [{"vendor": "usememos", "product": "memos", "programFiles": ["internal/webhook/validate.go"], "versions": [{"version": "0", "lessThanOrEqual": "0.29.1", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "baseScore": 8.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/usememos/memos"}, {"url": "https://github.com/usememos/memos/blob/main/internal/webhook/validate.go"}], "credits": [{"lang": "en", "value": "Alibek Baxtiyorov", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-05T12:26:18.502Z"}}}}

{}

{}

{}

{}