CVE-2026-55391

HIGH

MEDIUM Priority: 0.02 BB Relevance: 65/100

Published: 2026-07-28 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth No Interaction Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Network

AC: High

PR: None

UI: None

S: Changed

C: High

I: Low

A: None

Description

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.