Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
Affected: PyPI: keras
### Summary Keras’s model loader (KerasFileEditor) unsafely loads user-supplied .keras model files containing HDF5-based weight files without performing any validation on HDF5 dataset metadata. An attacker can craft a .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape (e.g. (50_000_000, 50_000_000)), but stores only a few bytes. The .keras file remains small (100–400 KB) because HDF5 with gzip compression stores minimal data. During model loading, Keras executes: `python result[key] = value[()] # loads entire dataset into memory` value[()] instructs h5py to allocate RAM proportional to the dataset’s declared shape – in this case 8.88 PiB of memory. This results in: Immediate memory exhaustion Python / TensorFlow crashes Jupyter kernel kill System instability Full Denial of Service on any workload that processes untrusted .keras models This allows an attacker to crash any environment or pipeline that loads .keras models, including MLOps backends, training services, model upload endpoints, or automated pipelines. ### Proof of Concept ``` // PoC.py import zipfile import io import h5py import numpy as np from keras.saving import KerasFileEditor
# Create a malicious .keras model containing a massive HDF5 shape bomb def create_malicious_keras(path="bomb.keras"): hdf5_bytes = io.BytesIO()
# Create an HDF5 file with a huge declared dataset shape with h5py.File(hdf5_bytes, "w") as f: d = f.create_dataset(…
Affected: PyPI: keras
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
github.com/containerd/containerd: containerd local privilege escalation vllm: Server Side request forgery (SSRF) in MediaConnector keras: Path Traversal Vulnerability in keras node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement transformers: code execution when processing a malicious Perceiver model file transformers: code execution when processing a malicious Transformer-XL model file diffusers: Hugging Face Diffusers: Remote Code Execution via Deserialization of Untrusted Data transformers: code execution when processing a malicious megatron_gpt2 model file accelerate: Hugging Face Accelerate: Remote Code Execution via Deserialization of Untrusted Data transformers: code execution when converting a malicious SEW model checkpoint transformers: code execution when converting a malicious SEW-D model checkpoint transformers: code execution when converting a malicious HuBERT model checkpoint transformers: code execution when processing a malicious X-CLIP model file transformers: code execution when processing a malicious GLM4 model file qs: qs: Denial of Service via improper input validation in array parsing vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects v…
Affected: Ubuntu:18.04:LTS: keras, Ubuntu:20.04:LTS: keras
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.