Skip to content
Threat Feed
Subscribe

Tag

Keras

2 briefs RSS
high advisory

CVE-2026-12480 Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras

A high-severity vulnerability, CVE-2026-12480, affects the `keras-team/keras` library, enabling an arbitrary HDF5 file read via a virtual dataset bypass, potentially leading to sensitive information disclosure or exfiltration from systems utilizing the library.

keras vulnerability arbitrary-file-read python machine-learning
1c
medium advisory

Keras Model Loader Vulnerable to Denial-of-Service via Malicious HDF5 Shape Bombs

Keras model loader is vulnerable to denial-of-service by loading specially crafted .keras files containing HDF5-based weight files with maliciously oversized dataset metadata, leading to immediate memory exhaustion during model loading.

Keras +2 denial-of-service hdf5 model-loading shape-bomb
2r 1t 1c 1i