Which versions of Google Keras are affected by CVE-2026-0897?

Google Keras versions 3.0.0 through 3.13.0 contain a denial-of-service vulnerability that allows remote attackers to crash Python interpreters by distributing malicious model files.. A patch is available.

How to fix or mitigate CVE-2026-0897?

Within 24 hours: Inventory all systems running Google Keras 3.0.0-3.13.0 and restrict model loading to trusted sources only. Within 7 days: Apply the vendor-released patch to all affected Keras installations per Google's advisory. Within 30 days: Implement input validation and sandboxing for model loading workflows, and conduct security awareness training for ML teams on malicious model risks.

Google Keras CVE-2026-0897

Q: What is the CVSS score of CVE-2026-0897?

CVE-2026-0897 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-01-15 cve-coordination@google.com

GHSA-xfhx-r7ww-5995

GHSA-mgx6-5cf9-rr43

Google Python Denial Of Service Keras

7.1

CVSS 4.0 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-delivered malicious model with no auth (PR:N) but requires the victim to load it (UI:R); impact is availability-only memory exhaustion, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 06:12 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 06:12 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 06:11 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 06:11 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:23 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:23 NVD

7.5 (HIGH) 7.1 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 23, 2026 - 18:35 nvd

Patch available

CVE Published

Jan 15, 2026 - 14:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on keras (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.

AnalysisAI

Memory-exhaustion denial of service in Google Keras 3.0.0 through 3.13.0 lets a remote attacker crash the Python interpreter by getting a victim to load a malicious .keras model archive. The crafted archive embeds a valid model.weights.h5 HDF5 file whose dataset declares an enormously large shape, so the weight loader attempts to allocate unbounded memory during deserialization. There is no public exploit identified at time of analysis, EPSS risk is low (0.03%), and a vendor fix is available.

Technical ContextAI

Keras is the high-level deep-learning API maintained by Google, distributed on PyPI and bundled into many ML stacks (TensorFlow, JAX, and PyTorch backends). The .keras serialization format is a ZIP archive containing the model config plus a model.weights.h5 file in the HDF5 binary format. When Keras loads weights it reads the dataset metadata from the HDF5 file - including the declared tensor shape - and pre-allocates buffers accordingly. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the loader trusts the attacker-controlled shape field and allocates memory proportional to it without validating it against the actual stored data or any sane upper bound, so an absurd shape forces an allocation that exhausts process memory and crashes the interpreter. The affected component is identified by CPE cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:* across all platforms.

RemediationAI

Upgrade Keras to a fixed release above 3.13.0 that incorporates the upstream fix from https://github.com/keras-team/keras/pull/21880; Red Hat users should apply the platform-specific updates in RHSA-2026:3782, RHSA-2026:3713, or RHSA-2026:4271 as applicable. The upstream fix is available as a PR, so the released patched version is not independently confirmed here - verify the exact fixed version against the merged PR or your distribution's advisory before deploying. Until patched, the most effective compensating control is to stop loading untrusted .keras / model.weights.h5 files: only deserialize models from trusted, integrity-verified sources, and treat user-uploaded models as hostile. For services that must accept external models, isolate the loading step in a sandboxed subprocess or container with a hard memory cgroup limit (ulimit/RLIMIT_AS or a container memory cap) so an oversized allocation kills only that worker rather than the host - the trade-off is added latency and operational complexity per load. Validating or capping declared dataset shapes before allocation is another mitigation but requires custom pre-parsing of the HDF5 file and may reject legitimately large models.