CVE-2026-0897
published 2026-01-15CVE-2026-0897: Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.33%
24.8th percentile
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | keras | — | — |
| keras-team | keras-team_keras | >= unspecified < 3.12.3, 3.15.0 | 3.12.3, 3.15.0 |
| keras | keras | >= 0 < 3.15.0 | 3.15.0 |
| keras | keras | >= 3.0.0 < 3.12.1 | 3.12.1 |
| keras | keras | 3.0.0 – 3.13.0 | — |
| keras | keras | >= 3.13.0 < 3.13.1 | 3.13.1 |
| keras | keras | >= 3.13.0 < 3.13.2 | 3.13.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa7.5HIGH
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function.
ghsa_unreviewed·2026-08-10·CVSS 7.5
CVE-2026-12570 [HIGH] CWE-770 A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function.
A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk to machine learning pipelines that process untrusted models.
GHSA
Keras model loading is vulnerable to denial of service through HDF5 shape bombs
ghsa·2026-08-10·CVSS 7.5
CVE-2026-12570 [HIGH] CWE-770 Keras model loading is vulnerable to denial of service through HDF5 shape bombs
Keras model loading is vulnerable to denial of service through HDF5 shape bombs
A vulnerability in keras-team/keras versions < 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk t
VulDB
Google Keras up to 3.13.0 allocation of resources (EUVD-2026-2735 / Nessus ID 291304)
vuldb·2026-05-07·CVSS 7.1
CVE-2026-0897 [HIGH] Google Keras up to 3.13.0 allocation of resources (EUVD-2026-2735 / Nessus ID 291304)
A vulnerability labeled as critical has been found in Google Keras up to 3.13.0. This affects an unknown part. Such manipulation leads to allocation of resources.
This vulnerability is listed as CVE-2026-0897. The attack may be performed from remote. There is no available exploit.
Applying a patch is advised to resolve this issue.
GHSA
Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)
ghsa·2026-05-06
CVE-2026-0897 [HIGH] CWE-770 Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)
Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)
### Summary
Keras’s model loader (KerasFileEditor) unsafely loads user-supplied .keras model files containing HDF5-based weight files without performing any validation on HDF5 dataset metadata. An attacker can craft a .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape (e.g. (50_000_000, 50_000_000)), but stores only a few bytes. The .keras file remains small (100–400 KB) because HDF5 with gzip compression stores minimal data. During model loading,
Keras executes:
`python
result[key] = value[()] # loads entire dataset into memory`
value[()] instructs h5py to allocate RAM proportional to the dataset’s declared shape – in this
OSV
Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
osv·2026-01-15
CVE-2026-0897 [HIGH] Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.12.0 and 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
GHSA
Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
ghsa·2026-01-15
CVE-2026-0897 [HIGH] CWE-770 Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.12.0 and 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
OSV
CVE-2026-0897: Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3
osv·2026-01-15·CVSS 7.1
CVE-2026-0897 [HIGH] CVE-2026-0897: Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
Red Hat
Keras: Keras: Denial of Service via crafted HDF5 weight loading file
vendor_redhat·2026-01-15·CVSS 7.1
CVE-2026-0897 [HIGH] CWE-770 Keras: Keras: Denial of Service via crafted HDF5 weight loading file
Keras: Keras: Denial of Service via crafted HDF5 weight loading file
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
A flaw was found in Keras. A remote attacker can cause a Denial of Service (DoS) by providing a specially crafted .keras archive containing a model weights file (model.weights.h5) that declares an extremely large data shape. This can lead to excessive memory allocation, resulting in memory exhaustion and a crash of the Python interpreter.
Debian
CVE-2026-0897: keras - Allocation of Resources Without Limits or Throttling in the HDF5 weight loading ...
vendor_debian·2026·CVSS 7.1
CVE-2026-0897 [HIGH] CVE-2026-0897: keras - Allocation of Resources Without Limits or Throttling in the HDF5 weight loading ...
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
Scope: local
bullseye: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-12570 keras: Keras: Denial of Service via HDF5 Shape Bomb when loading malicious model files
bugzilla·2026-08-10·CVSS 7.5
CVE-2026-12570 [HIGH] CVE-2026-12570 keras: Keras: Denial of Service via HDF5 Shape Bomb when loading malicious model files
CVE-2026-12570 keras: Keras: Denial of Service via HDF5 Shape Bomb when loading malicious model files
A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model regi
Wiz
CVE-2026-0897 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.1
CVE-2026-0897 [HIGH] CVE-2026-0897 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0897 :
Python vulnerability analysis and mitigation
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
Source : NVD
## 7.1
Score
Published January 15, 2026
Severity HIGH
CNA Score 7.1
Affected Technologies
Python
CBL Mariner
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 8.6
Exploitation Probability (EPSS) N/A
Affected packages and librari
https://github.com/keras-team/keras/pull/21880https://access.redhat.com/errata/RHSA-2026:3713https://access.redhat.com/errata/RHSA-2026:3782https://access.redhat.com/errata/RHSA-2026:4271https://access.redhat.com/security/cve/CVE-2026-0897https://bugzilla.redhat.com/show_bug.cgi?id=2430027https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0897.json
2026-01-15
Published