CVE-2026-0897
Fixed in a distro release EPSS <1%CVSS 7.1
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
Products: Google Keras, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat Trusted Artifact Signer 1.3, Red Hat OpenShift AI (RHOAI)
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | keras | 3.12.1 |
| PyPI | keras | 3.13.2 |
| PyPI | keras | 3.13.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kubeflow-pipelines-visualization-server | 2.15.0-r4 |
| Chainguard | tensorflow-cpu-jupyter | 2.20.0-r9 |
| Chainguard | tensorflow-gpu-jupyter | 2.20.0-r8 |
| Debian 11 | keras | no fix |
| Ubuntu 18.04 LTS | keras | no fix |
| Ubuntu 20.04 LTS | keras | no fix |
| Wolfi | kubeflow-pipelines-visualization-server | 2.15.0-r4 |
| Wolfi | tensorflow-cpu-jupyter | 2.20.0-r9 |