# CVE-2026-0897: Google Keras Denial of Service via HDF5 shape bomb in weight loading

Source: https://junglewise.ai/threats/cve-2026-0897-google-keras-denial-of-service-via-hdf5-shape-bomb-in-weight  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-15. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-0897 · Severity: high · CVSS 7.5 · Published 2026-01-15

A vulnerability in the Keras machine learning library allows an attacker to crash applications by providing a specially crafted model file. By including a 'shape bomb'—a file that claims to be extremely large—the attacker can force the system to run out of memory and stop functioning. This affects developers and organizations using Keras to load or process machine learning models, potentially leading to service outages.

Technologies: [keras (PyPI)](https://junglewise.ai/threats/technologies/keras), [Red Hat Trusted Artifact Signer](https://junglewise.ai/threats/technologies/trusted-artifact-signer). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-0897 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0897 being exploited in the wild.

**How severe is CVE-2026-0897?** High severity, with a CVSS score of 7.5, published 15 January 2026.

**Which products and versions are affected?** keras (PyPI) ECOSYSTEM:introduced=3.0.0,fixed=3.12.1, ECOSYSTEM:introduced=3.0.0,fixed=3.13.1; Red Hat Trusted Artifact Signer 1.3.

**Is there a fix for CVE-2026-0897?** Yes. keras (PyPI): upgrade to 3.12.1, 3.13.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0897 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-0897?** Check whether you run keras (PyPI) or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- keras (PyPI): upgrade to 3.12.1, 3.13.1 or later

  ```sh
  pip install "keras>=3.13.1"
  ```


## Technical details

An 'Allocation of Resources Without Limits or Throttling' vulnerability exists in the HDF5 weight loading component of Keras (specifically within KerasFileEditor). The root cause is a lack of validation for HDF5 dataset metadata, allowing 'shape bombs' where a dataset declares an extremely large shape or rank. When a victim loads a malicious .keras archive containing a crafted model.weights.h5 file, the Python interpreter attempts to allocate massive amounts of memory for NumPy tensors, leading to memory exhaustion and a crash. A fix has been introduced in Keras pull request #21880 which implements defensive size validation and a 1 GiB limit on HDF5 dataset allocations.

## Affected products

- Google Keras 3.0.0 through 3.13.0
- Red Hat OpenShift AI 2.25, 3.3
- Red Hat Trusted Artifact Signer 1.3

## Identifiers

- CVE-2026-0897
- GHSA-mgx6-5cf9-rr43
- PYSEC-2026-73

## Timeline

- 2025-11-29: other: Vulnerability reported and fix proposed via GitHub PR
- 2025-12-29: patched: Fix merged into Keras master branch
- 2026-01-15: disclosed: CVE published
- 2026-03-04: patched: Red Hat released security advisories for OpenShift AI

## References

- [https://github.com/keras-team/keras/pull/21880](https://github.com/keras-team/keras/pull/21880)
- [https://access.redhat.com/errata/RHSA-2026:3713](https://access.redhat.com/errata/RHSA-2026:3713)
- [https://access.redhat.com/errata/RHSA-2026:3782](https://access.redhat.com/errata/RHSA-2026:3782)
- [https://access.redhat.com/errata/RHSA-2026:4271](https://access.redhat.com/errata/RHSA-2026:4271)
- [https://access.redhat.com/security/cve/CVE-2026-0897](https://access.redhat.com/security/cve/CVE-2026-0897)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2430027](https://bugzilla.redhat.com/show_bug.cgi?id=2430027)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0897.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0897.json)

## Related threats

- [Keras model loading denial of service via HDF5 shape bombs](https://junglewise.ai/threats/cve-2026-12570-keras-model-loading-denial-of-service-via-hdf5-shape-bombs)
- [Keras HDF5 arbitrary file disclosure via ExternalLinks](https://junglewise.ai/threats/cve-2026-9335-keras-hdf5-arbitrary-file-disclosure-via-externallinks)
- [Keras unsafe deserialization in TorchModuleWrapper](https://junglewise.ai/threats/cve-2026-12484-keras-unsafe-deserialization-in-torchmodulewrapper)
- [Keras path traversal via symlink in filter_safe_tarinfos](https://junglewise.ai/threats/cve-2026-12482-keras-path-traversal-via-symlink-in-filter-safe-tarinfos)
- [Keras Team Keras arbitrary code execution in Lambda layer](https://junglewise.ai/threats/cve-2026-12481-keras-team-keras-arbitrary-code-execution-in-lambda-layer)