{"data":{"id":"2f72e93a-6ea9-4681-aa18-201ddc7838f0","title":"GHSA-mgx6-5cf9-rr43: Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)","summary":"The Keras model loader, KerasFileEditor, reads HDF5 weight files inside user-supplied .keras archives without validating dataset metadata. A crafted model.weights.h5 declaring a dataset shape of (50000000, 50000000) with only a few bytes of stored data triggers a full-shape allocation via value[()] in h5py, producing an attempted 8.88 PiB allocation that crashes the process. The advisory describes the impact as denial of service for any environment or pipeline that loads untrusted .keras models.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-mgx6-5cf9-rr43","publishedAt":"2026-05-06T23:09:37.000Z","cveId":"CVE-2026-0897","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["keras@>= 3.13.0, < 3.13.2 (fixed: 3.13.2)","keras@>= 3.0.0, <= 3.12.0 (fixed: 3.12.1)"],"affectedPackageNames":["keras"],"affectedPackageRefs":["pypi:keras"],"affectedVendors":["Google"],"affectedVendorsRaw":["Keras","TensorFlow","Google Colab"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0033,"epssCheckedAt":"2026-11-12T18:09:39.467Z","kevDateAdded":null,"advisoryAliases":["GHSA-mgx6-5cf9-rr43"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-06T23:09:37.000Z","fixReleasedAt":"2026-01-30T00:35:09.664Z","daysToFix":-96,"fixCheckedAt":"2026-10-29T21:36:48.670Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"keras","fixedVersion":"3.12.1","matchedVersion":"3.12.1","fixReleasedAt":"2026-01-30T18:28:54.383Z","daysToFix":-96,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:48.524Z"},{"ecosystem":"pypi","name":"keras","fixedVersion":"3.13.2","matchedVersion":"3.13.2","fixReleasedAt":"2026-01-30T00:35:09.664Z","daysToFix":-96,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:48.524Z"}]}}