Junglewise Threat Intelligence

CVE-2026-0897: Google Keras Denial of Service via HDF5 shape bomb in weight loading

CVE-2026-0897 · Severity: high · CVSS 7.5 · Published 2026-01-15

Technologies: keras (PyPI), Red Hat Trusted Artifact Signer. Vendors: PyPI, Red Hat, Google.

Executive brief

A vulnerability in the Keras machine learning library allows an attacker to crash applications by providing a specially crafted model file. By including a 'shape bomb'—a file that claims to be extremely large—the attacker can force the system to run out of memory and stop functioning. This affects developers and organizations using Keras to load or process machine learning models, potentially leading to service outages.

Technical details

An 'Allocation of Resources Without Limits or Throttling' vulnerability exists in the HDF5 weight loading component of Keras (specifically within KerasFileEditor). The root cause is a lack of validation for HDF5 dataset metadata, allowing 'shape bombs' where a dataset declares an extremely large shape or rank. When a victim loads a malicious .keras archive containing a crafted model.weights.h5 file, the Python interpreter attempts to allocate massive amounts of memory for NumPy tensors, leading to memory exhaustion and a crash. A fix has been introduced in Keras pull request #21880 which implements defensive size validation and a 1 GiB limit on HDF5 dataset allocations.

Affected products

  • Google Keras 3.0.0 through 3.13.0
  • Red Hat OpenShift AI 2.25, 3.3
  • Red Hat Trusted Artifact Signer 1.3

Timeline

  • 2025-11-29: other: Vulnerability reported and fix proposed via GitHub PR
  • 2025-12-29: patched: Fix merged into Keras master branch
  • 2026-01-15: disclosed: CVE published
  • 2026-03-04: patched: Red Hat released security advisories for OpenShift AI

References

Related threats