Answer in brief
CVE-2026-12570 records a Medium severity (CVSS 5.5) vulnerability in Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras. The current sources do not mark it as known exploited. The current feed maps keras-team/keras-team/keras (generic), keras (pip), keras (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps keras-team/keras-team/keras (generic), keras (pip), keras (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| keras-team/keras-team/kerasgeneric | >=unspecified <3.12.3, 3.15.0 | 3.12.3, 3.15.0 |
| keraspip | <3.15.0 | 3.15.0 |
| keraspypi | >=0 <3.15.0 | 3.15.0 |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk to machine learning pipelines that process untrusted models.
Quoted source text, attributed separately from HOL analysis.