CVE-2026-55391 in datamodel-code-generator
Summary
by MITRE • 07/29/2026
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/29/2026
The datamodel-code-generator vulnerability represents a critical DNS rebinding attack vector that undermines network security controls within the tool's HTTP request handling mechanism. This flaw affects versions prior to 063.0 and stems from an inconsistent validation approach where URL host validation occurs only once during initial processing but is subsequently bypassed during actual connection establishment.
The technical implementation of this vulnerability involves a two-stage process where the tool performs initial host validation through functions including get_body, _validate_url_for_fetch, and _get_ips_from_host in src/datamodel_code_generator/http.py. However, the subsequent httpx library connection process independently resolves DNS entries without applying the same validation constraints, creating an opportunity for attackers to manipulate DNS responses between the initial validation and final connection phases.
This vulnerability specifically targets the allow_private_network=False setting which is designed to prevent access to internal network services through external requests. The bypass occurs because the tool's validation logic does not persist across all stages of the HTTP request lifecycle, allowing malicious actors to redirect DNS queries to internal IP addresses that would otherwise be blocked by the private network restrictions.
The operational impact of this vulnerability extends beyond simple data exfiltration to potentially enable full internal network reconnaissance and exploitation. Attackers could leverage this flaw to access sensitive internal services, databases, or administrative interfaces that should remain isolated from external access. This represents a significant bypass of defense-in-depth principles where network segmentation controls are circumvented through manipulation of DNS resolution behavior.
Security practitioners must understand that this vulnerability aligns with CWE-209 and CWE-444 attack patterns related to improper input validation and HTTP response handling respectively, while also mapping to ATT&CK technique T1071.004 for application layer protocol tunneling. The attack surface includes any environment where datamodel-code-generator processes external schema definitions or API specifications that might contain malicious hostnames.
Mitigation strategies should focus on immediate version upgrading to 0.63.0 or later, where the validation logic has been corrected to maintain consistency across all connection stages. Organizations should also implement network-level controls such as DNS filtering and outbound firewall rules to limit access to internal services from development environments where this tool might be used. Additionally, security monitoring should be enhanced to detect unusual patterns of DNS resolution activity during code generation processes.
The vulnerability demonstrates the importance of consistent validation across all stages of request processing in security-sensitive applications, particularly when dealing with external input that may influence network connectivity. This flaw underscores the need for comprehensive testing of security controls throughout the entire request lifecycle rather than isolated validation points. Organizations using datamodel-code-generator should conduct thorough security assessments of their code generation workflows to identify any other potential bypasses or vulnerabilities in similar tools that might perform external resource fetching operations.
This issue also highlights the broader challenge of DNS-based attack vectors in modern development toolchains where network validation controls can be circumvented through seemingly innocuous design decisions. The fix implemented in version 0.63.0 represents a critical improvement in maintaining consistent security posture throughout the HTTP request handling process, ensuring that initial validation constraints remain effective during actual connection establishment rather than being bypassed through DNS resolution manipulation.