CVE-2026-0897

The record

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.

Affected packages

Related vulnerabilities

• CVE-2026-1669 Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions… Also affects keras
• GHSA-9g7v-8wxv-mwxp Duplicate Advisory: Keras keras.utils.get_file API is vulnerable to a path traversal… Also affects keras
• CVE-2025-12638 Keras version 3.11.3 is affected by a path traversal vulnerability in the… Also affects keras
• CVE-2025-12060 The keras.utils.get_file API in Keras, when used with the extract=True option for tar… Also affects keras
• CVE-2025-12058 The Keras.Model.load_model method, including when executed with the intended security… Also affects keras
• CVE-2024-55459 keras Path Traversal vulnerability Also affects keras
• CVE-2024-3660 A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows… Also affects keras
• CVE-2026-33230 NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and… Also affects kubeflow-pipelines-visualization-server