Executive Summary

This vulnerability in Google Keras (versions 3.0.0 through 3.13.0) allows a remote attacker to cause a Denial of Service (DoS) by exploiting the HDF5 weight loading component. Specifically, an attacker can craft a .keras archive containing a model.weights.h5 file with a dataset that declares an extremely large or malformed shape (known as an "HDF5 shape bomb"). When Keras attempts to load this file, it triggers excessive memory allocation, exhausting system resources and crashing the Python interpreter. The root cause is insufficient validation of dataset shapes and metadata during model loading. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a Denial of Service (DoS) on systems running vulnerable versions of Keras. An attacker can remotely trigger excessive memory consumption by providing a specially crafted .keras model file, leading to memory exhaustion and crashing the Python interpreter. This can disrupt services, halt machine learning workflows, and potentially cause downtime or loss of availability in applications relying on Keras for model loading. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for attempts to load maliciously crafted .keras model files containing HDF5 datasets with extremely large or malformed shapes that cause excessive memory allocation and crashes. Detection involves inspecting .keras files for suspiciously large dataset shapes or metadata. While no specific commands are provided, you can use HDF5 inspection tools such as 'h5dump' to examine the dataset shapes within model.weights.h5 files for unusually large dimensions or tensor ranks greater than 64. Additionally, monitoring Python interpreter crashes or high memory usage during model loading can indicate exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating Keras to a version that includes the patch addressing CVE-2026-0897, which enforces strict validation on HDF5 dataset metadata and imposes a maximum memory allocation limit of 1 GiB during model loading. Avoid loading untrusted or unauthenticated .keras model files. Implement defensive checks on dataset shapes before loading models to prevent resource exhaustion. Applying the patch from the KerasFileEditor component ensures rejection of hostile shapes and prevents Denial of Service via memory exhaustion. [1]

Useful 0 Not Useful 0