media-use

The code implements useful protocol, redirect, and response-size checks, but its public-host validation does not verify DNS resolution or the actual connected address. Consequently, a hostname resolving to an internal address can bypass the SSRF protection. No evidence of intentional malicious behavior is present.