CVE-2026-12570

Name of the Vulnerable Software and Affected Versions keras-team/keras versions prior to 3.15.1

Description A denial of service (DoS) issue occurs when loading malicious .keras model files using the keras.models.load model() function. The H5IOStore. getitem method in keras/src/saving/saving lib.py fails to validate the shape or size of datasets, which results in unbounded memory allocation. An attacker can use a specially crafted .keras file to trigger an out-of-memory (OOM) condition, causing the process to terminate. This flaw can be exploited through poisoned models from public repositories or malicious model registries, affecting machine learning pipelines that process untrusted models.

Recommendations Update to a version newer than 3.15.0. As a temporary workaround, avoid using the keras.models.load model() function to load models from untrusted sources.