{"data":{"id":"b0862dc1-8372-4b25-a9cf-a839596f2e52","title":"CVE-2026-12570: A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading maliciou","summary":"A vulnerability in Keras (a machine learning library) versions 3.15.0 and earlier allows attackers to crash applications by creating malicious .keras model files. When the keras.models.load_model() function opens these files, it doesn't check how much memory the data needs, causing the program to run out of memory (OOM, an out-of-memory condition where the system can't allocate more space) and crash. This risk affects machine learning pipelines that load models from untrusted sources like public repositories.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12570","publishedAt":"2026-08-10T07:16:44.370Z","cveId":"CVE-2026-12570","cweIds":["CWE-770"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["keras-team/keras","Keras"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-10T07:16:44.370Z","capecIds":["CAPEC-130"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}