Listen to this Post
The vulnerability exploits the HDF5 weight loading component in Google Keras when processing .keras archives. These archives contain model weights in an HDF5 file named model.weights.h5. HDF5 datasets include metadata defining their shape, such as dimensions and sizes. The vulnerable component reads this shape information without implementing checks on the declared size. An attacker can craft a .keras archive with a valid HDF5 file where the dataset shape is set to extremely large values, like [1000000000, 1000000000], representing terabytes or petabytes of data. During loading, Keras parses the shape and attempts to allocate memory proportional to this size. Since no limits or throttling are applied, the memory allocation request exceeds available system RAM. This triggers memory exhaustion, causing the Python interpreter to crash due to an out-of-memory error. The attack is remote as malicious archives can be loaded from untrusted sources, such as network downloads. The flaw stems from missing validation in versions 3.0.0 to 3.13.0, where the code trusts input shapes blindly. This leads to a Denial of Service (DoS) by crashing the application, affecting all platforms using Keras for model loading.
Platform: Google Keras
Version: 3.0.0-3.13.0
Vulnerability: Resource allocation unlimited
Severity: High
date: Jan 15 2026
Prediction: Patch date TBA
What Undercode Say:
Showing bash commands and codes related to the blog
pip show keras
python -c “import keras; print(keras.__version__)”
Check if vulnerable
with open(‘model.weights.h5’, ‘rb’) as f:
import h5py; data = h5py.File(f, ‘r’)
for key in data.keys():
print(data[bash].shape)
how Exploit:
Craft malicious .keras
Large shape HDF5
Trigger memory exhaustion
Protection from this CVE
Update Keras version
Validate input shapes
Limit memory usage
Impact:
Denial of Service
Memory exhaustion crash
Interpreter termination
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
