CVE-2026-0897

CVE-2026-0897 — Google Keras: ウェイト読み込みにおける HDF5 Shape Bomb によるサービス拒否DoS -orange?style=for-the-badge -brightgreen?style=for-the-badge 概要 フィールド| 詳細 ---|--- CVE ID| CVE-2026-0897 パッケージ| keras Google Keras レジストリ| PyPI 影響を受けるバージョン| 3.0.0 から 3.13.0 まで 両端を含む 脆弱性の種類| CWE-770: 制限またはスロットリングなしのリソース割り当て CVSS...

CVE-2026-0897

creationtimestamp| type| source ---|---|--- 2026-03-29 09:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/77758 2026-03-29 15:00:08+00:00| published-proof-of-concept| Telegram/Fln1CDV-IIlp7EGS7hrJibbBYDcdeDsNTgWenTzMncUGCI 2026-04-29 19:58:54+00:00| published-proof-of-concept|...

CVE-2026-0897 Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service DoS through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive...

CVE-2026-0897

CVE-2026-0897 affects Google Keras (3.0.0–3.13.0) via the HDF5 weight loading component. A crafted .keras archive containing a valid model.weights.h5 file with an extremely large dataset shape can trigger memory exhaustion and crash the Python interpreter, causing a Denial of Service. Some connec...