CVE-2026-0897
published 2026-01-15CVE-2026-0897: Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.30%
21.7th percentile
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | keras | — | — |
| keras | 3.0.0 – 3.13.0 | — | |
| keras | keras | >= 3.0.0 < 3.12.1 | 3.12.1 |
| keras | keras | 3.0.0 – 3.13.0 | — |
| keras | keras | >= 3.13.0 < 3.13.1 | 3.13.1 |
| keras | keras | >= 3.13.0 < 3.13.2 | 3.13.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Keras up to 3.13.0 allocation of resources (EUVD-2026-2735 / Nessus ID 291304)
vuldb·2026-05-07·CVSS 7.1
CVE-2026-0897 [HIGH] Google Keras up to 3.13.0 allocation of resources (EUVD-2026-2735 / Nessus ID 291304)
A vulnerability labeled as critical has been found in Google Keras up to 3.13.0. This affects an unknown part. Such manipulation leads to allocation of resources.
This vulnerability is listed as CVE-2026-0897. The attack may be performed from remote. There is no available exploit.
Applying a patch is advised to resolve this issue.
GHSA
Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)
ghsa·2026-05-06
CVE-2026-0897 [HIGH] CWE-770 Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)
Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)
### Summary
Keras’s model loader (KerasFileEditor) unsafely loads user-supplied .keras model files containing HDF5-based weight files without performing any validation on HDF5 dataset metadata. An attacker can craft a .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape (e.g. (50_000_000, 50_000_000)), but stores only a few bytes. The .keras file remains small (100–400 KB) because HDF5 with gzip compression stores minimal data. During model loading,
Keras executes:
`python
result[key] = value[()] # loads entire dataset into memory`
value[()] instructs h5py to allocate RAM proportional to the dataset’s declared shape – in this
OSV
Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
osv·2026-01-15
CVE-2026-0897 [HIGH] Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.12.0 and 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
GHSA
Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
ghsa·2026-01-15
CVE-2026-0897 [HIGH] CWE-770 Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.12.0 and 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
OSV
CVE-2026-0897: Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3
osv·2026-01-15·CVSS 7.1
CVE-2026-0897 [HIGH] CVE-2026-0897: Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
Red Hat
Keras: Keras: Denial of Service via crafted HDF5 weight loading file
vendor_redhat·2026-01-15·CVSS 7.1
CVE-2026-0897 [HIGH] CWE-770 Keras: Keras: Denial of Service via crafted HDF5 weight loading file
Keras: Keras: Denial of Service via crafted HDF5 weight loading file
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
A flaw was found in Keras. A remote attacker can cause a Denial of Service (DoS) by providing a specially crafted .keras archive containing a model weights file (model.weights.h5) that declares an extremely large data shape. This can lead to excessive memory allocation, resulting in memory exhaustion and a crash of the Python interpreter.
Debian
CVE-2026-0897: keras - Allocation of Resources Without Limits or Throttling in the HDF5 weight loading ...
vendor_debian·2026·CVSS 7.1
CVE-2026-0897 [HIGH] CVE-2026-0897: keras - Allocation of Resources Without Limits or Throttling in the HDF5 weight loading ...
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
Scope: local
bullseye: open
No detection rules found.
No public exploits indexed.
https://github.com/keras-team/keras/pull/21880https://access.redhat.com/errata/RHSA-2026:3713https://access.redhat.com/errata/RHSA-2026:3782https://access.redhat.com/errata/RHSA-2026:4271https://access.redhat.com/security/cve/CVE-2026-0897https://bugzilla.redhat.com/show_bug.cgi?id=2430027https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0897.json
2026-01-15
Published