Is CVE-2026-0897 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0897 being exploited in the wild.

How severe is CVE-2026-0897?

High severity, with a CVSS score of 7.5, published 15 January 2026.

Which products and versions are affected?

keras (PyPI) ECOSYSTEM:introduced=3.0.0,fixed=3.12.1, ECOSYSTEM:introduced=3.0.0,fixed=3.13.1; Red Hat Trusted Artifact Signer 1.3.

Is there a fix for CVE-2026-0897?

Yes. keras (PyPI): upgrade to 3.12.1, 3.13.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-0897 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-0897?

Check whether you run keras (PyPI) or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0897: Google Keras Denial of Service via HDF5 shape bomb in weight loading

CVE-2026-0897 · Severity: high · CVSS 7.5 · Published 2026-01-15

A vulnerability in the Keras machine learning library allows an attacker to crash applications by providing a specially crafted model file. By including a 'shape bomb'—a file that claims to be extremely large—the attacker can force the system to run out of memory and stop functioning. This affects developers and organizations using Keras to load or process machine learning models, potentially leading to service outages.

Technologies: keras (PyPI), Red Hat Trusted Artifact Signer. Vendors: PyPI, Red Hat.

Quick answers

Is CVE-2026-0897 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0897 being exploited in the wild.
How severe is CVE-2026-0897?: High severity, with a CVSS score of 7.5, published 15 January 2026.
Which products and versions are affected?: keras (PyPI) ECOSYSTEM:introduced=3.0.0,fixed=3.12.1, ECOSYSTEM:introduced=3.0.0,fixed=3.13.1; Red Hat Trusted Artifact Signer 1.3.
Is there a fix for CVE-2026-0897?: Yes. keras (PyPI): upgrade to 3.12.1, 3.13.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0897 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-0897?: Check whether you run keras (PyPI) or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keras (PyPI): upgrade to 3.12.1, 3.13.1 or later
```
pip install "keras>=3.13.1"
```

Technical details

An 'Allocation of Resources Without Limits or Throttling' vulnerability exists in the HDF5 weight loading component of Keras (specifically within KerasFileEditor). The root cause is a lack of validation for HDF5 dataset metadata, allowing 'shape bombs' where a dataset declares an extremely large shape or rank. When a victim loads a malicious .keras archive containing a crafted model.weights.h5 file, the Python interpreter attempts to allocate massive amounts of memory for NumPy tensors, leading to memory exhaustion and a crash. A fix has been introduced in Keras pull request #21880 which implements defensive size validation and a 1 GiB limit on HDF5 dataset allocations.

Affected products

Google Keras 3.0.0 through 3.13.0
Red Hat OpenShift AI 2.25, 3.3
Red Hat Trusted Artifact Signer 1.3

Identifiers

CVE-2026-0897
GHSA-mgx6-5cf9-rr43
PYSEC-2026-73

Timeline

2025-11-29: other: Vulnerability reported and fix proposed via GitHub PR
2025-12-29: patched: Fix merged into Keras master branch
2026-01-15: disclosed: CVE published
2026-03-04: patched: Red Hat released security advisories for OpenShift AI

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.