CVE-2026-0897: Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

Description

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 26% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

KE

Keras · Google

3.0.0 through 3.13.0 · source: vendor, NVD

RH

Red Hat OpenShift AI (RHOAI) · Red Hat

All versions, or not specified · source: CISA

RH

Red Hat OpenShift AI 2.25 · Red Hat

All versions, or not specified · source: CISA

RH

Red Hat OpenShift AI 3.3 · Red Hat

All versions, or not specified · source: CISA

RH

Red Hat Trusted Artifact Signer 1.3 · Red Hat

All versions, or not specified · source: CISA