CVE-2026-12570

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12570", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2026-06-18T01:55:25.311Z", "datePublished": "2026-08-10T06:29:56.111Z", "dateUpdated": "2026-08-10T17:37:39.037Z"}, "containers": {"cna": {"title": "Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2026-08-10T06:29:56.111Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk to machine learning pipelines that process untrusted models."}], "affected": [{"vendor": "keras-team", "product": "keras-team/keras", "versions": [{"version": "unspecified", "lessThan": "3.12.3, 3.15.0", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/a064f475-780a-409a-82f7-678512f27ad8"}, {"url": "https://github.com/keras-team/keras/commit/4933ea4a5b3fcc24ceacdc276f5bb5dfbd06756c"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "cweId": "CWE-770"}]}], "source": {"advisory": "a064f475-780a-409a-82f7-678512f27ad8", "discovery": "EXTERNAL"}}, "adp": [{"references": [{"url": "https://huntr.com/bounties/a064f475-780a-409a-82f7-678512f27ad8", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T17:37:17.637683Z", "id": "CVE-2026-12570", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T17:37:39.037Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12570", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2026-06-18T01:55:25.311Z", "datePublished": "2026-08-10T06:29:56.111Z", "dateUpdated": "2026-08-10T17:37:39.037Z"}, "containers": {"cna": {"title": "Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2026-08-10T06:29:56.111Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk to machine learning pipelines that process untrusted models."}], "affected": [{"vendor": "keras-team", "product": "keras-team/keras", "versions": [{"version": "unspecified", "lessThan": "3.12.3, 3.15.0", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/a064f475-780a-409a-82f7-678512f27ad8"}, {"url": "https://github.com/keras-team/keras/commit/4933ea4a5b3fcc24ceacdc276f5bb5dfbd06756c"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "cweId": "CWE-770"}]}], "source": {"advisory": "a064f475-780a-409a-82f7-678512f27ad8", "discovery": "EXTERNAL"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12570", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T17:37:17.637683Z"}}}], "references": [{"url": "https://huntr.com/bounties/a064f475-780a-409a-82f7-678512f27ad8", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T17:37:35.339Z"}}]}}

{"affected": [{"affectedData": [{"product": "keras-team/keras", "vendor": "keras-team", "versions": [{"lessThan": "3.12.3, 3.15.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@huntr.dev"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk to machine learning pipelines that process untrusted models."}, {"lang": "es", "value": "Una vulnerabilidad en las versiones menor o igual que 3.15.0 de keras-team/keras permite un ataque de denegaci\u00f3n de servicio (DoS) al cargar archivos de modelo .keras maliciosos a trav\u00e9s de la funci\u00f3n keras.models.load_model(). El m\u00e9todo H5IOStore.__getitem__ en keras/src/saving/saving_lib.py no valida la forma o el tama\u00f1o de los conjuntos de datos, lo que lleva a una asignaci\u00f3n de memoria ilimitada. Un archivo .keras especialmente dise\u00f1ado puede explotar esta falla para desencadenar una condici\u00f3n de falta de memoria (OOM), lo que provoca la terminaci\u00f3n del proceso (c\u00f3digo de salida 137). Este problema elude la correcci\u00f3n para CVE-2026-0897, que solo abord\u00f3 una vulnerabilidad similar en KerasFileEditor. El vector de ataque incluye modelos envenenados de repositorios p\u00fablicos o registros de modelos maliciosos, lo que representa un riesgo para las tuber\u00edas de aprendizaje autom\u00e1tico que procesan modelos no confiables."}], "id": "CVE-2026-12570", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security@huntr.dev", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12570", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T17:37:17.637683Z", "version": "2.0.3"}}]}, "published": "2026-08-10T07:16:44.370", "references": [{"source": "security@huntr.dev", "url": "https://github.com/keras-team/keras/commit/4933ea4a5b3fcc24ceacdc276f5bb5dfbd06756c"}, {"source": "security@huntr.dev", "url": "https://huntr.com/bounties/a064f475-780a-409a-82f7-678512f27ad8"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://huntr.com/bounties/a064f475-780a-409a-82f7-678512f27ad8"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security@huntr.dev", "type": "Secondary"}]}

{"bugzilla": {"description": "keras: Keras: Denial of Service via HDF5 Shape Bomb when loading malicious model files", "id": "2513026", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513026"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Keras. When loading malicious .keras model files using the keras.models.load_model() function, the H5IOStore.__getitem__ method does not validate the shape or size of datasets. This can lead to unbounded memory allocation, allowing a malicious actor to trigger an out-of-memory condition and cause a denial of service. This vulnerability poses a risk to machine learning pipelines that process untrusted models."], "mitigation": {"lang": "en:us", "value": "Only load .keras model files from trusted sources; do not load user-supplied or externally-sourced model files without validation. Apply pod-level memory limits/requests to constrain the blast radius of an out-of-memory condition until an upstream fix is available."}, "name": "CVE-2026-12570", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-kserve-agent-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-kserve-controller-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-kserve-router-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-kserve-storage-initializer-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-modelmesh-runtime-adapter-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-08-10T06:29:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-12570\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-12570\nhttps://github.com/keras-team/keras/commit/4933ea4a5b3fcc24ceacdc276f5bb5dfbd06756c\nhttps://huntr.com/bounties/a064f475-780a-409a-82f7-678512f27ad8"], "statement": "Red Hat ships Keras across multiple OpenShift AI (RHOAI) model-serving and workbench images: KServe agent, controller, router, and storage-initializer images, the ModelMesh runtime adapter image, TensorFlow pipeline-runtime images, and Jupyter TensorFlow workbench images (CUDA and ROCm variants). The keras.models.load_model() function does not validate HDF5 dataset shape or size when loading .keras model files, allowing a malicious or untrusted model file to trigger unbounded memory allocation and a denial of service (out-of-memory) on the serving/workbench pod.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.15.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "keras-team/keras", "source": "cna", "vendor": "keras-team"}, "product": "keras", "vendor": "keras-team"}], "created": "2026-08-10T07:30:14.034429+00:00", "updated": "2026-08-11T14:26:07.853550+00:00", "vendors": ["keras-team", "keras-team$PRODUCT$keras"]}