Keras CVE-2026-0897: HDF5 Shape Bomb Causes OOM Vulnerability and Patch

Vulnerability Overview CVE-2026-0897 is an unpatched vulnerability affecting the method in . This method suffers from memory allocation issues when handling HDF5 shape bombs, potentially leading to the process being killed by the OOM (Out of Memory) killer. Impact Scope Affected Versions: on PyPI versions <= 3.15.0 Vulnerability Type: CWE-770: Allocation of Resources Without Limits or Throttling Severity: Medium (5.5) Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Confidentiality Impact: None Integrity Impact: None Availability Impact: High Remediation The fix involves adding shape/size validation to , similar to the remediation applied to . The specific code is as follows: Proof of Concept (POC) Step 1 -- Create malicious file Step 2 -- Load (Victim) Observations Malicious file size: ~7 KB Memory allocation attempt: 4,000,000,000,000 bytes (4 TB) Amplification factor: ~571,000,000x Exit code: 137 (SIGKILL), host OS was also killed in the test environment (WSL2). Call Stack Why CVE-2026-0897 Fix is Incomplete PR #21880 only modified (KerasFileEditor). (H5IOStore) was not updated. is an optional developer utility, whereas is the code path invoked by . Impact Loading a malicious model file leads to unlimited memory allocation via , resulting in the process being OOM-killed (exit code 137). A 7 KB file triggers an attempt to allocate 4 TB of memory (~571 million times amplification). Any ML pipeline that loads untrusted Keras models is susceptible to process-level or host-level denial of service. Attack vectors include poisoned models in the HuggingFace Hub or malicious model registries. Occurrence

Goal Reached Thanks to every supporter — we hit 100%!

Keras CVE-2026-0897: HDF5 Shape Bomb Causes OOM Vulnerability and Patch