Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-102877 · Microsoft / collected KEV context

cve-program · CVE-2026-102877

• https://github.com/getfider/fider/security/advisories/GHSA-whx4-hxwq-qgjh
• https://github.com/getfider/fider/commit/45f5627b9fd15b912fb9092635c863fb4c91dd69
• https://github.com/getfider/fider/blob/v0.37.0/app/pkg/validate/general.go
• https://github.com/getfider/fider/blob/v0.37.0/app/services/httpclient/httpclient.go
• https://github.com/getfider/fider/releases/tag/v0.38.0
• https://github.com/getfider/fider
• https://www.vulncheck.com/advisories/fider-before-0.38.0-ssrf-via-dns-rebinding-in-webhook-validation

No related operational record is retained in the current change model.