{"items":[{"id":"NVI-00018497","kind":"vulnerability","title":"Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-mgx6-5cf9-rr43","CVE-2026-0897"],"plain_summary":"GitHub lists this reviewed advisory for keras, keras. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-30c011f72459a8cfbdaeee18472c8cc5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-30c011f72459a8cfbdaeee18472c8cc5","url":"https://github.com/advisories/GHSA-mgx6-5cf9-rr43","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mgx6-5cf9-rr43","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:52:42.537Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-30c011f72459a8cfbdaeee18472c8cc5"],"technology":"keras","known_exclusions":[],"conditions_summary":"### Summary\nKeras’s model loader (KerasFileEditor) unsafely loads user-supplied .keras model files containing HDF5-based weight files without performing any validation on HDF5 dataset metadata. An attacker can craft a .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape (e.g. (50_000_000, 50_000_000)), but stores only a few bytes. The .keras file remains small (100–400 KB) because HDF5 with gzip compression stores minimal data. During model loading, \nKeras executes:\n`python\nresult[key] = value[()]   # loads entire dataset into memory`\nvalue[()] instructs h5py to allocate RAM proportional to the dataset’s declared shape – in this case 8.88 PiB of memory. This results in: Immediate memory exhaustion Python / TensorFlow crashes Jupyter kernel kill System instability Full Denial of Service on any workload that processes untrusted .keras models This allows an attacker to crash any environment or pipeline that loads .keras models, including MLOps backends, training services, model upload endpoints, or automated pipelines.\n### Proof of Concept\n```\n// PoC.py\nimport zipfile\nimport io\nimport h5py\nimport numpy as np\nfrom keras.saving import K","public_affected_ranges":[">= 3.0.0, <= 3.12.0"]},{"certainty":"source_listed","source_ids":["sr-30c011f72459a8cfbdaeee18472c8cc5"],"technology":"keras","known_exclusions":[],"conditions_summary":"### Summary\nKeras’s model loader (KerasFileEditor) unsafely loads user-supplied .keras model files containing HDF5-based weight files without performing any validation on HDF5 dataset metadata. An attacker can craft a .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape (e.g. (50_000_000, 50_000_000)), but stores only a few bytes. The .keras file remains small (100–400 KB) because HDF5 with gzip compression stores minimal data. During model loading, \nKeras executes:\n`python\nresult[key] = value[()]   # loads entire dataset into memory`\nvalue[()] instructs h5py to allocate RAM proportional to the dataset’s declared shape – in this case 8.88 PiB of memory. This results in: Immediate memory exhaustion Python / TensorFlow crashes Jupyter kernel kill System instability Full Denial of Service on any workload that processes untrusted .keras models This allows an attacker to crash any environment or pipeline that loads .keras models, including MLOps backends, training services, model upload endpoints, or automated pipelines.\n### Proof of Concept\n```\n// PoC.py\nimport zipfile\nimport io\nimport h5py\nimport numpy as np\nfrom keras.saving import K","public_affected_ranges":[">= 3.13.0, < 3.13.2"]}],"null_published_at":"2026-11-07T07:07:39.843Z","source_updated_at":"2026-06-08T18:34:14.000Z","source_disclosed_at":"2026-05-06T23:09:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:52:42.537Z"}],"next_cursor":null,"snapshot_revision":"42594"}