The vulnerability exists in usememos memos' webhook dispatch function safeDialContext() located in internal/webhook/webhook.go. The function resolves the target hostname using net.DefaultResolver.LookupHost() and validates the resulting IP addresses against reserved IP ranges to prevent SSRF attacks. However, when dialing the target, it uses net.JoinHostPort(host, port) with the original hostname instead of the validated IP address. Since net.Dialer.DialContext() performs its own DNS resolution independently, an attacker controlling the DNS for the webhook's hostname can exploit this by returning a public IP during validation and a different internal IP at dial time. This classic TOCTOU DNS rebinding bypass allows circumventing SSRF protections, potentially exposing internal network resources.

Successful exploitation can lead to server-side request forgery (SSRF) bypass, allowing attackers to make unauthorized requests to internal or otherwise protected network resources. The CVSS score of 8.5 (high) reflects the potential for high confidentiality impact and partial integrity impact without availability impact. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting DNS resolution for webhook hostnames or implementing additional validation to ensure the dialed IP matches the validated IP. Avoid relying solely on hostname validation when dialing network connections.