7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-0897

CVE-2026-0897: Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-0897

CVE-2026-0897:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
keras	pip	>= 3.0.0, <= 3.13.0	3.13.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the HDF5 weight loading component of Keras. Specifically, the _extract_weights_from_store function in keras/src/saving/file_editor.py was identified as the vulnerable function. The analysis of the patch commit 7360d4f0d764fbb1fa9c6408fe53da41974dd4f6 reveals that the vulnerability was due to the lack of validation on the shape and size of datasets within the HDF5 file before they were loaded into memory. The original code would directly load the dataset, which could lead to excessive memory allocation if the dataset's metadata was maliciously crafted to declare a very large shape. The patch mitigates this by introducing several checks: it validates the dataset's shape for negative dimensions and excessive rank, calculates the potential memory footprint, and compares it against a hardcoded limit (MAX_BYTES = 4 GiB). The dataset is only loaded if it passes these validation checks. Therefore, any runtime profile during the exploitation of this vulnerability would show the KerasFileEditor._extract_weights_from_store function being called before the process crashes due to memory exhaustion.

Vulnerable functions

KerasFileEditor._extract_weights_from_store

keras/src/saving/file_editor.py

The function `_extract_weights_from_store` is responsible for loading model weights from an HDF5 file. In the vulnerable version, it directly loaded a dataset using `value[()]` without checking the dataset's metadata. An attacker could craft an HDF5 file with a dataset declaring an extremely large shape. When this function attempted to load the weights, it would try to allocate a massive amount of memory, leading to memory exhaustion and a Denial of Service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.