CVE-2026-0897: Keras Denial of Service Vulnerability in HDF5 Weight Loading Component
Summary
CVE-2026-0897: Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component. Affects keras versions >= 3.0.0, < 3.13.1. Fixed in 3.13.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Google Keras is an open-source neural network library written in Python, designed to simplify the process of building and training deep learning models. It provides a user-friendly API and supports multiple backends, making it a popular choice among developers and researchers. However, versions 3.0.0 through 3.13.0 are vulnerable to a Denial of Service (DoS) attack due to improper resource allocation in the HDF5 weight loading component.
Vulnerability Detail
The vulnerability arises from the HDF5 weight loading component in Google Keras, where it allocates resources without limits or throttling. This allows a remote attacker to exploit the system by sending a crafted .keras archive containing a valid model.weights.h5 file with an extremely large dataset shape. The result is memory exhaustion, leading to a crash of the Python interpreter and causing a Denial of Service (DoS). The vulnerability is classified under CWE-770, indicating improper resource management.
How To Fix
Latest published version: 3.15.1 as of 22 Oct 2026
pip install --upgrade "keras==3.15.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.1
This is the first release that contains the fix.
pip install --upgrade "keras==3.13.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid loading .keras archives from untrusted sources or ensure that the datasets within the archives do not declare excessively large shapes. This can help mitigate the risk of triggering the vulnerability until an update can be applied.
Conclusion
The vulnerability identified as CVE-2026-0897 in Google Keras poses a significant risk due to improper resource allocation in the HDF5 weight loading component. Users are advised to update to version 3.13.1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for keras →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
Keras versions from 3.0.0 to 3.13.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update Keras immediately, avoid loading .keras archives from untrusted sources and ensure that datasets do not declare excessively large shapes as a temporary measure.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software using just the Pipfile.lock. It helps you stay informed about potential vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for keras.
