EUVD-2026-55002
GHSA-74m6-m3xx-3vmj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
AV:L because exploitation requires the crafted file to be present on the local filesystem; UI:R since a user or pipeline must actively invoke load_model(); A:H for guaranteed deterministic process termination; no confidentiality or integrity impact.
Primary rating from Vendor (huntr_ai).
CVSS VectorVendor: huntr_ai
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk to machine learning pipelines that process untrusted models.
AnalysisAI
Unbounded memory allocation in Keras (keras-team/keras) versions ≤ 3.15.0 allows an attacker who can supply a crafted .keras or HDF5 weights file to crash the loading process via an out-of-memory condition. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py performs no validation of HDF5 dataset shapes against actual on-disk storage, enabling 'shape bomb' files that declare enormous in-memory sizes (e.g., ~8 PiB) while occupying negligible disk space. ML pipelines that consume models from public repositories, third-party registries, or untrusted collaborators are directly at risk; this flaw bypasses the earlier fix for CVE-2026-0897, which only addressed the same class of issue in KerasFileEditor. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Keras serializes and deserializes neural network weights using the HDF5 format via the h5py library. The affected code path is H5IOStore.__getitem__ → safe_get_h5_dataset in keras/src/saving/saving_lib.py (CPE: cpe:2.3:a:keras-team:keras-team/keras:*:*:*:*:*:*:*:*). HDF5 supports chunked, compressed datasets with fill values, meaning a dataset can declare an arbitrarily large logical shape while storing almost nothing on disk - a pattern sometimes called a 'shape bomb' or 'decompression bomb,' closely related to CWE-409 (Improper Handling of Highly Compressed Data). The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): safe_get_h5_dataset does not compare the declared in-memory footprint (shape × dtype.itemsize) against the actual bytes stored on disk (dataset.id.get_storage_size()), so carefully crafted HDF5 metadata can force gigabytes or petabytes of memory allocation. The patch introduces a 4 GiB floor threshold (_H5_DATASET_BOMB_FLOOR_BYTES = 1 << 32) and a 1000× maximum expansion ratio (_H5_DATASET_MAX_EXPANSION) before any allocation proceeds, rejecting datasets that exceed both limits.
RemediationAI
Apply the upstream fix from commit 4933ea4a5b3fcc24ceacdc276f5bb5dfbd06756c (https://github.com/keras-team/keras/commit/4933ea4a5b3fcc24ceacdc276f5bb5dfbd06756c); a specific patched release version is not independently confirmed from available data, so monitor the keras-team/keras PyPI releases for a version incorporating this commit and upgrade promptly. As an immediate workaround, restrict model loading to files sourced exclusively from internal, integrity-verified repositories by implementing SHA-256 or GPG signature verification on .keras and .weights.h5 files before passing them to load_model() or load_weights(); the trade-off is added pipeline complexity and key management overhead. Where automated pipelines must consume external models, run load_model() inside a memory-limited subprocess using Python's resource.setrlimit (RLIMIT_AS or RLIMIT_DATA) or container-level memory limits (e.g., Docker --memory), so an OOM crash is contained rather than propagating to the parent process; this mitigates impact but does not prevent the DoS. Enforcing strict model provenance policies - allowlisting only known-good model registries - directly addresses the primary attack vector described in the disclosure.
More in Keras Team Keras
View allArbitrary code execution in keras-team/keras 3.14.0 lets remote attackers run OS-level commands by supplying a malicious
Arbitrary code execution in Keras 3.13.0 occurs because the TFSMLayer class unconditionally loads attacker-supplied Tens
Local HDF5 file content disclosure in keras-team/keras versions 3.14.0 and earlier allows an attacker who can deliver a
Symlink entries in malicious tar archives bypass the `filter_safe_tarinfos` validation in Keras 3.12.0, enabling directo
Path traversal in Keras 3.14.0 exposes local file systems to arbitrary file and directory creation when processing malic
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today