Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-24623.json"