keras-team Keras up to 3.15.0 H5IOStore saving_lib.py H5IOStore.__getitem__ allocation of resources

Summaryinfo

A vulnerability has been found in keras-team Keras up to 3.15.0 and classified as problematic. This impacts the function H5IOStore.__getitem__ of the file keras/src/saving/saving_lib.py of the component H5IOStore. The manipulation leads to allocation of resources. This vulnerability is documented as CVE-2026-12570. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in keras-team Keras up to 3.15.0. It has been rated as problematic. This issue affects the function H5IOStore.__getitem__ of the file keras/src/saving/saving_lib.py of the component H5IOStore. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is availability. The summary by CVE is:

A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk to machine learning pipelines that process untrusted models.

The advisory is shared at huntr.com. The identification of this vulnerability is CVE-2026-12570 since 06/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-55002). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• keras-team

Name

• Keras

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion