CyberSecBulletin
CVE-2026-55391NVD status: Analyzed

datamodel-code-generator: Reliance on Reverse DNS Resolution for a Security-Critical Action

Published Updated By the CyberSecBulletin desk

CVE-2026-55391 is a high-severity reliance on reverse DNS resolution for a security-critical action vulnerability in datamodel-code-generator from Koxudaxi, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected datamodel-code-generator versions: < 0.63.0. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.3% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Check which version of datamodel-code-generator you run against the affected versions below, and install the vendor's latest release.
  2. Read the advisory on github.com for workarounds and exact fixed builds.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Koxudaxidatamodel-code-generator< 0.63.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
LowLimited modification of data is possible.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N. Scored by CNA (github.com).

Official description

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Reliance on Reverse DNS Resolution for a Security-Critical Action

The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.

How developers prevent this class of flaw

  • Use other means of identity verification that cannot be simply spoofed. Possibilities include a username/password or certificate.
  • Perform proper forward and reverse DNS lookups to detect DNS spoofing.

More Reliance on Reverse DNS Resolution for a Security-Critical Action vulnerabilities (CWE-350)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: poc, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Other vulnerabilities in datamodel-code-generator

All datamodel-code-generator vulnerabilities

Recent Reliance on Reverse DNS Resolution for a Security-Critical Action vulnerabilities

Spotted an error? Tell us.