OESA-2026-4052 python-Keras security update

Keras is a high-level neural networks API for Python. Security Fixes: A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-12480 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-12480 Source advisory: OSV:PYSEC-2026-3629...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-12481 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-12481 Source advisory: OSV:PYSEC-2026-3631...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-12482 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-12482 Source advisory: OSV:PYSEC-2026-3630...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-12484 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-12484 Source advisory: OSV:PYSEC-2026-3634...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-12479 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-12479 Source advisory: OSV:PYSEC-2026-3632...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-12570 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-12570 Source advisory: OSV:GHSA-74M6-M3XX-3VMJ...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-9335 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-9335 Source advisory: OSV:GHSA-M8WH-29WM-52MV...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-12484 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-12484 Source advisory: OSV:GHSA-V2W2-W228-C444...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-12482 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-12482 Source advisory: OSV:GHSA-58HV-7753-XMFQ...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-1462 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-1462 Source advisory: OSV:PYSEC-2026-2547...

CVE-2026-12479

A flaw was found in Keras, specifically in the model saving and loading library. This path traversal vulnerability occurs due to improper handling of user-provided layer names, which allows an attacker to craft a malicious Keras model. When this model is saved or loaded, it can escape its intende...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2025-12060 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2025-12060 Source advisory: OSV:PYSEC-2026-1486...

Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery

The Keras.Model.loadmodel method, including when executed with the intended security mitigation safemode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery SSRF.This vulnerability stems from the way the StringLookup layer is handled during model loading from a...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-12480 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-12480 Source advisory: OSV:GHSA-26C4-7VV6-867J...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-12479 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-12479 Source advisory: OSV:GHSA-GH82-F9X8-5FRX...

CVE-2026-12479 Path Traversal in keras-team/keras

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the DiskIOStore.make method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths...

CVE-2026-12479

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the DiskIOStore.make method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-11816 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-11816 Source advisory: OSV:GHSA-HQP4-2352-XF5R...

Keras Model Code Execution

The vulnerability of the Model.loadmodel function in the Keras library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...