Listen to this Post
datamodel-code-generator is a widely used Python library that generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to version 0.63.0, the tool includes an anti-SSRF (Server-Side Request Forgery) protection mechanism designed to block requests to private IP addresses, link-local addresses, and reserved ranges. This protection is enabled by default via the `allow_private_network=False` flag, which is intended to prevent the tool from reaching internal services when fetching remote schemas or references.
The vulnerability arises from a Time-of-Check to Time-of-Use (TOCTOU) race condition in the DNS resolution process. In src/datamodel_code_generator/http.py, the function `get_body()` calls _validate_url_for_fetch(), which resolves the hostname using `_get_ips_from_host()` (via socket.getaddrinfo) and validates that all resolved IPs are global (non-private). If any resolved IP is private, link-local, or reserved, the validation raises an error and blocks the request. However, after this validation passes, the function proceeds to make the actual HTTP request using httpx.get(). Critically, `httpx` performs its own independent DNS resolution to establish the connection, and the validated IP address is never pinned or reused.
This creates a window of opportunity for an attacker to exploit DNS rebinding. An attacker can control a domain with a very low TTL (Time-To-Live) DNS record. During the validation step, the domain resolves to a public IP address (which passes the `allow_private_network=False` check). Immediately after validation, the attacker changes the DNS response to a private IP address (e.g., 127.0.0.1, 169.254.169.254, or an internal RFC 1918 address). When `httpx` resolves the hostname for the actual connection, it receives the private IP and connects to the internal service, completely bypassing the SSRF protection.
The vulnerability is particularly dangerous because it can be triggered in normal usage scenarios. An attacker can register a rebinding hostname and trick the tool into fetching a malicious URL via the `–url` command-line parameter or through a remote `$ref` in a supplied OpenAPI or JSON Schema document (remote references are fetched by default). The impact includes reading cloud instance metadata (e.g., AWS, GCP, Azure credentials from 169.254.169.254), reaching internal HTTP services, and performing port/host probing of the internal network. The content fetched from the internal target is parsed and may be reflected in the generated output, leading to information disclosure.
The issue is fixed in version 0.63.0, where the validated DNS result is pinned and reused for the connection, eliminating the TOCTOU gap. The maintainer confirmed the vulnerability and merged a private fix PR. The CVE was published on July 28, 2026, with a CVSS v3.1 base score of 7.5 (High), reflecting a network-based attack with high complexity, no privileges required, no user interaction, a changed scope, high confidentiality impact, and low integrity impact.
DailyCVE Form:
Platform: Python Package
Version: < 0.63.0
Vulnerability: SSRF Bypass (DNS Rebinding)
Severity: High (CVSS 7.5)
Date: 2026-07-28
Prediction: Patch expected 2026-08-15
What Undercode Say: Analytics
- Attack Vector: Network-based, requiring attacker-controlled DNS.
- Attack Complexity: High due to DNS rebinding timing.
- Privileges Required: None.
- User Interaction: None.
- Scope: Changed (internal network reached).
- Confidentiality Impact: High (internal data exposure).
- Integrity Impact: Low (potential data modification).
- Availability Impact: None.
- Exploit Maturity: Proof-of-concept available.
- Automatable: No (requires precise timing).
- EPSS Score: 0.19% (as of 2026-07-29).
Bash Commands & Codes:
Check installed version:
pip show datamodel-code-generator | grep Version
Upgrade to patched version:
pip install --upgrade datamodel-code-generator>=0.63.0
Verify fix:
python -c "import datamodel_code_generator; print(datamodel_code_generator.<strong>version</strong>)"
PoC reproduction (requires patched `socket.getaddrinfo`):
Run internal target server python -m http.server 8080 & Run datamodel-code-generator with malicious rebinding domain datamodel-code-generator --url http://attacker-controlled.rebind/schema.json
Exploit
An attacker can exploit this vulnerability by:
- Registering a malicious domain with a very low TTL (e.g., 0 or 1 second).
- Configuring the DNS server to return a public IP address (e.g., 8.8.8.8) during the initial validation query.
- Immediately switching the DNS response to a private IP address (e.g., 127.0.0.1, 169.254.169.254, or 192.168.1.1) for subsequent queries.
- Tricking the tool into fetching a schema from the malicious domain via `–url` or a remote
$ref. - The tool validates the public IP, passes the guard, then `httpx` resolves the private IP and connects to the internal service.
- The internal response is parsed and potentially reflected in the generated code, exposing sensitive information.
A self-contained proof-of-concept is available at: https://gist.github.com/thegr1ffyn/c1d54dd6ff2a4c0d7d0dabe00c4985f4
Protection
- Upgrade to datamodel-code-generator version 0.63.0 or later immediately.
- If unable to upgrade, avoid fetching schemas from untrusted or attacker-influenced URLs.
- Use network-layer controls such as egress firewalls to block outbound requests to private IP ranges.
- Implement DNS filtering to detect and block rebinding domains.
- Review CI/CD pipelines that use this tool and ensure they do not process external, untrusted schemas.
- Monitor for unexpected outbound connections from the tool to internal IP addresses.
Impact
- Confidentiality: Exposure of internal service data, including cloud instance metadata (IAM credentials, user-data, etc.) and sensitive internal API responses.
- Integrity: Low impact; attacker may be able to modify data in internal services if they support write operations.
- Availability: No direct impact, but internal services could be disrupted if abused.
- Scope: Internal network may be fully probed and accessed, bypassing the intended private-network protection.
- Affected Environments: Any deployment or CI pipeline that runs datamodel-code-generator against attacker-influenced URLs. This includes development, testing, and production environments where the tool is used to generate models from remote schemas.
- Remediation Timeline: The fix was released in version 0.63.0 on July 28, 2026. All users are strongly advised to upgrade immediately.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
