7.1
Élevée
CVE-2026-0897 Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0…
Description
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Keras 3.0 | 3.0.0 → 3.13.0 | Pas de correctif indiqué |
| Red Hat OpenShift AI 2.25 1772093272 | premières → < 1772093272 | 1772093272 |
| Red Hat OpenShift AI 3.3 1771502884 | premières → < 1771502884 | 1771502884 |
| Red Hat Trusted Artifact Signer 1.3 1772614635 | premières → < 1772614635 | 1772614635 |
| Red Hat OpenShift AI (RHOAI) | Versions non publiées |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Keras
Les 4 CVE de Keras →
CVE-2026-1669
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all…
7.1
Élevée
CVE-2025-8747
A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an…
8.6
Élevée
CVE-2025-1550
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually…
7.3
Élevée