Memos' webhook dispatch function safeDialContext() (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost() and validates…

CVE-2026-71272 describes a Server-Side Request Forgery (SSRF) protection bypass in the Memos application's webhook dispatch function safeDialContext() located in internal/webhook/webhook.go. The vulnerability is a classic Time-of-Check/Time-of-Use (TOCTOU) race condition involving DNS rebinding. The function resolves a target hostname via net.DefaultResolver.LookupHost() and validates the resulting IP against reserved/internal ranges, but then dials the connection using the original hostname rather than the validated IP. Because net.Dialer.DialContext() performs its own independent DNS resolution, an attacker who controls DNS for the webhook hostname can serve a legitimate public IP during validation and switch to an internal IP at dial time. This allows an attacker to bypass SSRF protections and potentially access internal network resources. The fix requires dialing using the already-validated IP address rather than re-resolving the hostname.