Memos' webhook dispatch function safeDialContext performs DNS resolution of the target hostname via net.DefaultResolver.LookupHost, validates the returned IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already‑validated IP address. This creates a time‑of‑check/time‑of‑use gap: an attacker who controls the DNS entry for the webhook hostname can provide a benign IP during validation and a private internal IP when the connection is made, effectively bypassing the intended SSRF guard and allowing the service to reach internal network resources that should otherwise be blocked. The flaw can lead to unauthorized disclosure of internal data or further exploitation of internal services.

The flaw exists in the usememos Memos web application. No specific product version was given, so any version before the patch that includes the safeDialContext() fix is potentially vulnerable. Administrators should consult the Memos release notes to determine if the current installation includes the correction.

The CVSS v3.1 score is 8.5, classifying it as High severity. EPSS of 0.00175 indicates a very low exploitation probability, and the vulnerability is not yet listed in CISA’s KEV catalog, so the exact likelihood of exploitation remains unknown. Nevertheless, the attack vector involves remote control of a DNS provider, which is a realistic scenario for attackers who can influence DNS or are in possession of short‑TTL records. The exploitation directly leads to SSRF to internal addresses, posing significant confidentiality and availability risks.