Denial of Service Vulnerability in Keras by keras-team

CVE-2026-12570

What is CVE-2026-12570?

A flaw in Keras versions up to 3.15.0 allows for denial of service attacks when loading .keras model files through the keras.models.load_model() function. This vulnerability arises because the H5IOStore.getitem method does not properly validate the size or shape of datasets, leading to potential unbounded memory allocation. Attackers can create specially crafted .keras files that exploit this issue, causing out-of-memory conditions and terminating the process unexpectedly. The risk is heightened for machine learning pipelines that may incorporate untrusted or poisoned models from public repositories or malicious model registries.

References