EUVD-2026-55002
GHSA-74m6-m3xx-3vmj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
AV:L because exploitation requires the crafted file to be present on the local filesystem; UI:R since a user or pipeline must actively invoke load_model(); A:H for guaranteed deterministic process termination; no confidentiality or integrity impact.
Primary rating from Vendor (huntr_ai).
CVSS VectorVendor: huntr_ai
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk to machine learning pipelines that process untrusted models.
AnalysisAI
Unbounded memory allocation in Keras (keras-team/keras) versions ≤ 3.15.0 allows an attacker who can supply a crafted .keras or HDF5 weights file to crash the loading process via an out-of-memory condition. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py performs no validation of HDF5 dataset shapes against actual on-disk storage, enabling 'shape bomb' files that declare enormous in-memory sizes (e.g., ~8 PiB) while occupying negligible disk space. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target process must call keras.models.load_model() or load_weights() on a file controlled by the attacker - specifically a .keras archive or .weights.h5 file containing an HDF5 dataset with a maliciously large declared shape relative to its actual stored bytes (e.g., shape=(2**50,) with chunked gzip compression and a fill value). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.5 (Medium) with a local attack vector (AV:L) and required user interaction (UI:R) constrains opportunistic exploitation in theory, but the practical risk in ML-intensive organizations substantially exceeds what the raw score implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a Keras-compatible model to a public model hub, embedding an HDF5 dataset that declares a shape of 2^50 float64 elements (approximately 8 PiB in memory) while storing near-zero bytes on disk using chunked gzip compression with a fill value of 0.0. When a data scientist or CI/CD pipeline calls keras.models.load_model() on this file, h5py attempts to allocate the full declared memory, immediately exhausting available RAM and triggering a process kill with exit code 137. … |
| Remediation | Apply the upstream fix from commit 4933ea4a5b3fcc24ceacdc276f5bb5dfbd06756c (https://github.com/keras-team/keras/commit/4933ea4a5b3fcc24ceacdc276f5bb5dfbd06756c); a specific patched release version is not independently confirmed from available data, so monitor the keras-team/keras PyPI releases for a version incorporating this commit and upgrade promptly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Keras Team Keras
View allArbitrary code execution in keras-team/keras 3.14.0 lets remote attackers run OS-level commands by supplying a malicious
Arbitrary code execution in Keras 3.13.0 occurs because the TFSMLayer class unconditionally loads attacker-supplied Tens
Local HDF5 file content disclosure in keras-team/keras versions 3.14.0 and earlier allows an attacker who can deliver a
Symlink entries in malicious tar archives bypass the `filter_safe_tarinfos` validation in Keras 3.12.0, enabling directo
Path traversal in Keras 3.14.0 exposes local file systems to arbitrary file and directory creation when processing malic
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today