Well, in my case this was accepted . This is an ext. ssrf because we get a response from the server by an external third party system.