A server-side request forgery (SSRF) issue exists in the `web crawl` tool. The software validates hostnames at check time using the ` is safe crawl url()` function to reject private, loopback, or link-local IPs, but it does not pin the resolved IP. Consequently, the backend re-resolves the hostname at connection time. An attacker can use DNS rebinding—a technique where a domain returns a public IP during validation and an internal IP during the actual fetch—to bypass these protections. This allows the retrieval of internal HTTP response bodies from private or loopback services. The issue affects multiple backends, including `httpx`, `urllib`, and `crawl4ai` (headless Chromium). Specifically, the ` crawl with httpx()` function and the `web crawl` tool are affected.