CVE-2026-71272

8.5 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows attackers to manipulate hostname resolution and potentially execute code by exploiting DNS rebinding or similar techniques.
Exploitability: Exploitation requires control over DNS records and network conditions that allow DNS rebinding, making it moderately difficult.
Blast radius: If exploited, the impact could be high, allowing remote code execution on affected systems.
Prioritized remediation: Update Memos to use validated IP addresses in the dialing process instead of the original hostname.

rcedns-rebindingwebhooknetwork

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP address.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Weaknesses

CWE-367

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.