CVE-2026-0897

HIGH

Keras 3.0.0-3.13.0 - Denial of Service via HDF5 Weight Loading

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-0897. PoCs published by SecureWithUmer, HyperPS.

AI-analyzed exploit summary Detailed technical analysis of CVE-2026-0897, a Denial of Service vulnerability in Google Keras (versions 3.0.0-3.13.0) caused by unbounded memory allocation when processing HDF5 dataset shape metadata in .keras archives. The writeup includes root cause analysis, patch diffs, and a functional PoC for generating malicious model files.

Description

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.

Exploits (2)

github WRITEUP
by SecureWithUmer · c++poc
https://github.com/SecureWithUmer/CVE-2026-PoCs/tree/main/2026/CVE-2026-0897

Detailed technical analysis of CVE-2026-0897, a Denial of Service vulnerability in Google Keras (versions 3.0.0-3.13.0) caused by unbounded memory allocation when processing HDF5 dataset shape metadata in .keras archives. The writeup includes root cause analysis, patch diffs, and a functional PoC for generating malicious model files.

Classification
Writeup 99%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Google Keras 3.0.0 through 3.13.0
No auth needed
Prerequisites: Victim must load a malicious .keras archive
mistral-large-3 · analyzed Jul 08, 2026 Full analysis →
nomisec WRITEUP
by HyperPS · poc
https://github.com/HyperPS/CVE-2026-0897

This repository provides a detailed technical analysis of CVE-2026-0897, a Denial of Service vulnerability in Google Keras due to unbounded memory allocation when loading HDF5 weight files with malicious shape metadata. It includes root cause analysis, CVSS breakdown, and a partial PoC generation script.

Classification
Writeup 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Google Keras 3.0.0–3.13.0
No auth needed
Prerequisites: Victim must load a malicious .keras archive
mistral-large-3 · analyzed Apr 09, 2026 Full analysis →

References (7)

Core 7

Scores

CVSS v3 7.5
EPSS 0.0030
EPSS Percentile 22.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-770
Status published
Products (4)
Google/Keras 3.0.0 - 3.13.0
keras/keras 3.0.0 - 3.13.0
pypi/keras 3.0.0 - 3.12.1PyPI
pypi/keras 3.13.0 - 3.13.2PyPI
Published Jan 15, 2026
Tracked Since Feb 18, 2026