VYPR
← All advisories
High severity7.7NVD Advisory· Published May 7, 2026· Updated May 7, 2026

CVE-2026-41688

CVE-2026-41688

Description

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT_RESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window. At time of publication, there are no publicly available patches.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Ellite/Wallosreferences2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: <=4.8.4

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.