GHSA-xfhx-r7ww-5995

Source

https://github.com/advisories/GHSA-xfhx-r7ww-5995

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xfhx-r7ww-5995/GHSA-xfhx-r7ww-5995.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xfhx-r7ww-5995

Downstream

CGA (3)

MINI (1)

MINI-h5jp-w9f3-8f63

Withdrawn

2026-05-06T23:06:56Z

Published

2026-01-15T15:31:19Z

Modified

2026-09-10T03:50:33Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Duplicate Advisory: Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mgx6-5cf9-rr43. This link is maintained to preserve external references.

Original Description

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.12.0 and 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.

Database specific

{
    "cwe_ids":  [
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-01-15T20:11:41Z",
    "nvd_published_at":  "2026-01-15T14:16:26Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / keras

Package

Name: keras; View open source insights on deps.dev
Purl: pkg:pypi/keras

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.12.1

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.1.0

3.1.1

3.2.0

3.2.1

3.3.0

3.3.1

3.3.2

3.3.3

3.4.0

3.4.1

3.5.0

3.6.0

3.7.0

3.8.0

3.9.0

3.9.1

3.9.2

3.10.0

3.11.0

3.11.1

3.11.2

3.11.3

3.12.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xfhx-r7ww-5995/GHSA-xfhx-r7ww-5995.json"