CVE-2024-29028 memos vulnerable to an SSRF in /o/get/httpmeta

What is CVE-2024-29028?

CVE-2024-29028 is a medium-severity server-side request forgery vulnerability in Usememos Memos, published on 19 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1.

Weakness: CWE-918

Which versions are affected by CVE-2024-29028?

3 open source packages ship an affected version, including github.com/usememos/memos. It affects 1 product.

Products include Usememos Memos.

How do I fix CVE-2024-29028?

Upgrade github.com/usememos/memos to 0.16.1 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-29028 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29028 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Usememos Memos

• CVE-2025-50738 Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs Critical 9.8
• CVE-2025-22952 Memos Server-Side Request Forgery (SSRF) Critical 9.8
• CVE-2023-0109 Stored XSS in usememos/memos Critical 9.8
• CVE-2023-4696 Improper Access Control in usememos/memos Critical 9.8
• CVE-2022-4866 Cross-site Scripting (XSS) - Stored in usememos/memos Critical 9.8

All Usememos Memos vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6fcf-g3mp-xj2x, GO-2024-3047.