Executive brief
Keras is a popular machine learning library used to build and load trained neural network models. A vulnerability in versions before 3.15.0 allows an attacker to craft a malicious model file that causes the application to consume unbounded memory and crash when loaded, disrupting any ML pipeline that processes untrusted models from public repositories or model registries.
Technical details
The vulnerability exists in Keras's HDF5 dataset loading code (keras/src/saving/saving_lib.py, H5IOStore.__getitem__ method) which does not validate the declared shape or size of datasets before materialization. An attacker can craft a specially-designed HDF5 file with chunked, compressed, or fill-value-only datasets that declare an enormous shape (e.g., petabytes) while storing only kilobytes on disk. When load_model() or load_weights() is called on such a file, the code attempts to allocate memory equal to the declared shape, causing an out-of-memory condition and process termination (exit code 137). The attack requires user interaction to load the model but no privileges; the attack vector is local/network-supplied malicious model files from untrusted sources. The patch (released in v3.15.0) adds validation to reject datasets where the declared in-memory size exceeds a 4 GiB floor and vastly exceeds the actual on-disk storage size.
Affected products
- Keras Team Keras < 3.15.0
Timeline
- 2026-08-10: disclosed: Vulnerability published to GitHub Advisory Database and NVD
- 2026-06-23: patched: Fix released in Keras v3.15.0 (commit 4933ea4); patch merged June 1, 2026
- 2026-09-01: advisory: GitHub Security Advisory reviewed and updated