CVE-2026-12570: keras-team/keras denial of service via malicious .keras model files

Summary

CVE-2026-12570 affects keras-team/keras versions up to and including 3.15.0. A crafted .keras file loaded through keras.models.load_model() can make H5IOStore.__getitem__ in keras/src/saving/saving_lib.py allocate memory without bound, because dataset shape and size are not validated. The resulting out-of-memory condition terminates the process with exit code 137, and the flaw bypasses the earlier fix for CVE-2026-0897.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• kerasPyPINo LLM dependency detected · 6 tracked dependents

Related items

• HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
• MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database
• CriticalCVE-2026-48705: MONAI PydicomReader affine computation accepts non-finite DICOM valuesSimilar attack · NVD/CVE Database
• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence