CVE-2026-55391 affects datamodel-code-generator, a tool that generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from various schema formats. Prior to version 0.63.0, the tool validates a URL host once during the initial check but then allows httpx to independently resolve the host for the actual connection. This creates a DNS rebinding vulnerability that can bypass the allow_private_network=False security control. An attacker could exploit this flaw to reach internal services that should be inaccessible from external contexts. The vulnerability exists in src/datamodel_code_generator/http.py, specifically in the get_body, _validate_url_for_fetch, and _get_ips_from_host functions. The issue has been resolved in version 0.63.0 of the package. Users are strongly advised to upgrade to the fixed version to prevent potential unauthorized access to internal network resources.