Log in Start free

Vulnerability · Published Jan 15, 2026 · Assigned by Google

CVE-2026-0897Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

High 7.6

In plain English

A high-severity resource allocation without limits in Keras from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.3%top 73.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIkeras3.12.1GHSA-mgx6-5cf9-rr43
PyPIkeras3.13.2GHSA-mgx6-5cf9-rr43
PyPIkeras3.13.1PYSEC-2026-73

Affected products (as reported)

VendorProductVersions
Google Keras 3.0.0 – through 3.13.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

References