CVE-2026-0897

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.12.0 and 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.

An adversary targeting an organization running an automated model evaluation platform or transfer learning pipeline crafts a valid .keras archive. The archive contains a well-formed model.weights.h5 with a legitimate HDF5 header but declares a dataset shape with extreme dimensions (e.g., [2147483647, 2147483647]). When the pipeline invokes keras.saving.load_model() or loads the weights file, the HDF5 component attempts to pre-allocate memory proportional to the declared shape before reading actual data. System RAM is exhausted within seconds, the Python interpreter crashes via an unhandled MemoryError, and the inference worker or training job is terminated. In containerized ML workloads without memory limits, this can cascade to OOMKill events affecting co-located services. No authentication, no ML expertise, and no network-level access beyond file delivery to the target pipeline are required.