CVE-2026-12570 in Keras
Summary
by MITRE • 08/10/2026
A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk to machine learning pipelines that process untrusted models.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical denial of service weakness in the popular deep learning framework Keras affecting versions up to 3.15.0. The flaw resides in the H5IOStore._getitem_ method within keras/src/saving/saving_lib.py, which fails to implement proper validation mechanisms for dataset shapes and sizes during model loading operations. When maliciously crafted .keras model files are processed through the keras.models.load_model() function, the absence of input sanitization allows attackers to manipulate memory allocation patterns in ways that can exhaust available system resources. The vulnerability operates at the core of Keras's model persistence layer, specifically targeting how the framework handles hierarchical data format storage structures commonly used in machine learning model serialization.
The technical exploitation occurs when an attacker crafts a .keras file containing malformed dataset specifications that appear valid to the parser but trigger unbounded memory consumption during deserialization. The H5IOStore._getitem_ method processes these datasets without size or shape validation, allowing malicious inputs to cause memory allocation that grows beyond system limits. This particular implementation flaw falls under CWE-704, which addresses improper input validation in data processing systems, and aligns with ATT&CK technique T1203 for legitimate credential use and T1499 for network disruption through resource exhaustion. The vulnerability's impact is amplified by its ability to bypass previous security measures implemented for CVE-2026-0897, indicating a regression or incomplete remediation that leaves the framework vulnerable to similar attack patterns.
The operational consequences of this vulnerability extend beyond simple service interruption to compromise entire machine learning pipelines and development environments. When systems process untrusted model files from public repositories or malicious registries, they become susceptible to out-of-memory conditions that terminate processes with exit code 137, effectively disabling the application and potentially causing data loss or system instability. Attackers can leverage this weakness by uploading poisoned models to shared platforms, thereby targeting multiple downstream consumers who automatically load these models without additional security validation. The attack vector is particularly dangerous in production environments where automated model deployment systems continuously fetch and process new model versions from external sources.
Organizations utilizing Keras for machine learning workloads must implement immediate mitigations including version upgrades to patched releases that address the unbounded memory allocation issue. Additional protective measures should involve implementing strict input validation at the application level, using sandboxed environments for model loading operations, and establishing comprehensive model verification procedures before deployment. Security teams should consider implementing network segmentation to limit access to trusted model repositories and deploy monitoring solutions capable of detecting unusual memory consumption patterns during model loading phases. The vulnerability underscores the importance of proper resource management in data processing frameworks and highlights the need for continuous security testing of serialization mechanisms within machine learning ecosystems to prevent similar issues from emerging in future releases.