What is the CVSS score of EUVD-2026-53357?

EUVD-2026-53357 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Memos are affected by EUVD-2026-53357?

Memos webhook dispatcher contains a DNS rebinding vulnerability (CVE-2026-71272) enabling authenticated users to bypass SSRF protections and access internal network resources.

How to fix or mitigate EUVD-2026-53357?

Within 24 hours: disable Memos webhook functionality if not actively required, and apply firewall rules to restrict outbound connections from the Memos application to only approved external services. Within 7 days: implement network segmentation isolating Memos from sensitive internal systems, and deploy DNS response policy zones to block DNS rebinding attacks. Within 30 days: monitor Memos GitHub repository and security advisories for a vendor-released patch, and conduct a forensic audit of webhook dispatcher logs to detect potential exploitation attempts.

Memos EUVD-2026-53357

| CVE-2026-71272 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-08-05 TuranSec

GHSA-w8cc-xr9f-mrh7

SSRF Memos Usememos

8.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

DNS rebinding requires controlling authoritative DNS and winning a timing race, justifying AC:H over the vendor's AC:L; PR:L retained as webhook creation requires authentication.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:39 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 8.5

DescriptionCVE.org

Memos' webhook dispatch function safeDialContext() (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost() and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP address. Because net.Dialer.DialContext() performs its own independent DNS resolution, an attacker controlling DNS for the webhook's hostname (e.g. via a short TTL) can return a public, allowed IP during validation and a different, internal IP at dial time - a classic time-of-check/time-of-use DNS-rebinding bypass of the SSRF protection.

AnalysisAI

DNS rebinding bypass of SSRF protection in Memos' webhook dispatcher allows a low-privileged authenticated attacker to reach internal network resources by exploiting a time-of-check/time-of-use race in hostname resolution. The safeDialContext() function in internal/webhook/webhook.go validates the resolved IP against reserved ranges but then re-dials using the original hostname, allowing the underlying net.Dialer.DialContext() to perform a second, independent DNS lookup that the attacker controls. By setting a short TTL on an attacker-controlled domain and swapping the DNS response between validation and dial, an attacker can cause Memos to connect to arbitrary internal addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope change (S:C) and high confidentiality impact reflect the risk of internal service enumeration and data exfiltration.

Technical ContextAI

Memos is an open-source, self-hosted note and memo application (cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*). Its webhook feature dispatches HTTP requests to user-configured URLs via a Go function safeDialContext() located at internal/webhook/webhook.go. The function attempts to enforce an SSRF safeguard by calling net.DefaultResolver.LookupHost() on the target hostname and comparing the returned IPs against RFC-1918 and other reserved ranges. However, after validation, it reconstructs the dial target using net.JoinHostPort(host, port) - the original hostname string - and passes this to net.Dialer.DialContext(), which performs its own fresh DNS resolution. This constitutes a classic CWE-367 (Time-of-Check Time-of-Use) race condition: the DNS answer used for the security check is not guaranteed to match the answer used at dial time. An attacker controlling a domain's DNS (e.g., via a short TTL and a custom authoritative nameserver) can exploit this gap to cause Memos to connect to an internal address that was never validated.

RemediationAI

The definitive fix requires that after the initial DNS validation resolves a hostname to an approved IP, the application must dial that specific validated IP address directly rather than re-passing the original hostname to the dialer. In Go, this means substituting the validated IP for the hostname in the dial target (e.g., using net.JoinHostPort(validatedIP, port) rather than net.JoinHostPort(host, port)) so that net.Dialer.DialContext() cannot perform an independent DNS lookup. No patched release version was confirmed in the available references - the upstream fix status should be tracked at https://github.com/usememos/memos. As a compensating control pending a patch, operators can restrict webhook creation permissions to fully trusted administrators only, reducing the PR:L attack surface. Additionally, deploying Memos behind a network egress filter (e.g., an HTTP proxy with an allowlist or an iptables rule blocking outbound connections to RFC-1918 ranges from the Memos process) would limit what internal resources are reachable even if the SSRF bypass is triggered. Note that egress filtering at the network layer is a defense-in-depth measure and does not address the root cause.