https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T16:49:29.752006+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349663 EUVD-2026-349663 2026-10-05T16:49:29.798155+00:00 EUVD-2026-349663 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71271 fkie_cve-2026-71271 2026-10-05T16:49:29.798196+00:00

Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/html_meta.go, which does.

 https://cve.radiocsirt.org/vuln/ghsa-jjh5-p3gc-84xr GHSA-jjh5-p3gc-84xr 2026-10-05T16:49:29.798233+00:00

Memos' webhook URL validation, isReservedIP() (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified() — unlike the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go, which does. Because Linux redirects connections to 0.0.0.0 to loopback (127.0.0.1), an attacker registering a webhook URL of http://0.0.0.0:PORT/ bypasses the reserved-IP check and causes the Memos server to make outbound HTTP requests to its own loopback interface, exposing internal-only services.