CVE-2026-0897

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.

Score

CVSS 3.1 7.6 High

Status

Modified - cve-coordination@google.com

Published

2026-01-15

Last modified

2026-07-15

Weaknesses

CWE-770

Affected products

• Keras (Google)
• Keras (Keras)
• Openshift Ai (Redhat)
• Trusted Artifact Signer (Redhat)

References

• https://github.com/keras-team/keras/pull/21880
• https://access.redhat.com/errata/RHSA-2026:3713
• https://access.redhat.com/errata/RHSA-2026:3782
• https://access.redhat.com/errata/RHSA-2026:4271
• https://access.redhat.com/security/cve/CVE-2026-0897
• https://bugzilla.redhat.com/show_bug.cgi?id=2430027
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0897.json