CVE-2026-55391 Details
Description
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.
A server-side request forgery (SSRF) vulnerability has been identified in datamodel-code-generator versions prior to 0.63.0. The issue arises from the tool's handling of DNS resolutions when fetching remote schema references. During this process, the tool validates the IP address of a URL host to ensure it is safe for fetching schema data. However, it then allows the HTTP client to perform a separate DNS resolution for the actual connection. This creates a time-of-check to time-of-use (TOCTOU) vulnerability, where an attacker can manipulate the DNS resolution to bypass the validation and access internal services or metadata endpoints.
Users can upgrade to datamodel-code-generator version 0.63.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-350 | Reliance on Reverse DNS Resolution for a Security-Critical Action | [email protected] |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| koxudaxi datamodel-code-generator | < 0.63.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |