CVE-2026-55391: Datamodel code generator Datamodel-code-generator Vulnerable To SSRF Protection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vx7x-vcc2-c44g",
  "modified" : "2026-07-28T21:45:48Z",
  "published" : "2026-07-28T21:45:48Z",
  "aliases" : [ "CVE-2026-55391" ],
  "summary" : "datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding",
  "details" : "### Summary\n\n`datamodel-code-generator`'s anti-SSRF guard validates the resolved IP of a fetch target once and then lets `httpx` perform its own independent DNS resolution to connect, so the validated address is never pinned. A hostname that resolves to a public IP at validation time and a private IP at connection time (DNS rebinding) bypasses the guard and reaches loopback, link-local cloud-metadata endpoints (`169.254.169.254`), and other internal services — even with the default `allow_private_network=False`. This is a server-side request forgery reachable when the tool fetches an attacker-influenced URL (remote `$ref`, or `--url`).\n\n### Details\n\nIn `src/datamodel_code_generator/http.py`, `get_body()` calls `_validate_url_for_fetch()`, which resolves the host via `_get_ips_from_host()` (`socket.getaddrinfo`) and rejects non-global addresses:\n\n```python\nips = _get_ips_from_host(host)            # resolution #1 (validation)\nif not ips: return\nif all(_is_safe_ip(ip) for ip in ips): return\nraise SchemaFetchError(...)               # blocks private/link-local/reserved\n```\n\nIt then connects with a separate, independent resolution:\n\n```python\nresponse = httpx.get(current_url, ...)    # resolution #2 (connection) -- NOT pinned to #1\n```\n\nNothing ties the connection to the IP that passed validation. Between the two resolutions a low-TTL attacker-controlled record can flip from a public address (passes the guard) to a private one (used by the connection). The redirect-handling loop in the same function does correctly re-validate each redirect URL, so this is specifically a TOCTOU/rebinding gap in the host-to-IP check, not a redirect issue.\n\n### PoC\n\nSelf-contained reproducer: https://gist.github.com/thegr1ffyn/c1d54dd6ff2a4c0d7d0dabe00c4985f4 \nIt starts a loopback HTTP server standing in for an internal target and patches `socket.getaddrinfo` to return a public IP on the guard's lookup and `127.0.0.1` on httpx's  the standard deterministic way to demonstrate this TOCTOU class (the real-world trigger is a low-TTL rebinding DNS record the attacker controls). \n\nReachability in normal use: the attacker registers a rebinding hostname and gets the tool to fetch `http://that-host/schema.json` either via `--url` or via a remote `$ref` in a supplied schema (remote refs are fetched on the default configuration).\n\n### Impact\n\nServer-side request forgery (CWE-918) via a time-of-check/time-of-use resolution gap (CWE-367). Any service or CI pipeline that runs `datamodel-code-generator` against attacker-influenced URLs is affected, including deployments that rely on the default private-network protection. Consequences include reading cloud instance-metadata credentials (`169.254.169.254`), reaching internal-only HTTP services, and port/host probing of the internal network, the document fetched from the internal target is also parsed and can be reflected into the generated output.\n\n### Maintainer status\n\nConfirmed by maintainer review and regression tests. The private fix PR was merged and released in `0.63.0`: https://github.com/koxudaxi/datamodel-code-generator-ghsa-vx7x-vcc2-c44g/pull/1\n\nFix summary: pin the validated DNS result set during the HTTP fetch so a host cannot resolve to a safe address during validation and a different address during connection.\n\nRelease status: fixed in `0.63.0`; `0.62.0` and earlier are affected.\n\nValidation: `uv run --group test --extra http pytest tests/test_http.py` passed locally for DNS pinning and URL-fetch regression coverage; `uv run --group fix ruff check src/datamodel_code_generator/http.py tests/test_http.py` passed.\n\nSubmitted by: Hamza Haroon (thegr1ffyn)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "datamodel-code-generator"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.63.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.62.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-vx7x-vcc2-c44g"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/koxudaxi/datamodel-code-generator/commit/25c8b7e497419eb20b230fa3318c04f9bebc5a6f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/koxudaxi/datamodel-code-generator"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.63.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-350", "CWE-367", "CWE-918" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-28T21:45:48Z",
    "nvd_published_at" : null
  }
}