SB20261109122 - Allocation of Resources Without Limits or Throttling in Keras

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109122

SB20261109122 - Allocation of Resources Without Limits or Throttling in Keras

Published: November 9, 2026

Security Bulletin ID SB20261109122
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-0897)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause memory exhaustion and denial of service in environments processing untrusted Keras models.

The vulnerability exists due to unrestricted memory allocation from unvalidated HDF5 dataset dimensions when KerasFileEditor loads a crafted .keras archive. An unauthenticated remote attacker can supply a small model file declaring enormous dataset dimensions and persuade a victim to open it, triggering a petabyte-scale allocation attempt that crashes the process.


Remediation

Install update from vendor's website.

References