CVE-2026-9335

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-9335
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9335.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-9335
Downstream
Published
2026-08-02T03:49:25.096Z
Modified
2026-08-04T03:32:31.029164976Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Improper Handling of HDF5 ExternalLinks in keras-team/keras
Details

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "@huntr_ai",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9335.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "3.12.3, 3.15.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/keras-team/keras

Affected ranges

Type
GIT
Repo
https://github.com/keras-team/keras
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
23370f16b0ab9a200f7550a34e54a3ceab74ba0e
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.3.0
0.3.1
0.3.2
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.1.0
1.1.1
1.2.0
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.3.0
2.3.1
2.4.0
v2.*
v2.6.0-rc0
v2.7.0-rc0
v2.8.0-rc0
v2.9.0-rc0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.1.0
v3.1.1
v3.10.0
v3.11.0
v3.12.0
v3.14.0
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.4.0
v3.4.1
v3.5.0
v3.6.0
v3.7.0
v3.8.0
v3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9335.json"