CVE-2026-0897

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
GoogleKeras>= 3.0.0, <= 3.13.0
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 3.3—
Red HatRed Hat OpenShift AI 3.3—
Red HatRed Hat OpenShift AI 3.3—
Red HatRed Hat OpenShift AI 3.3—
Red HatRed Hat Trusted Artifact Signer 1.3—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—

References

Timeline

Published
Jan 15, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-08989.0An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome CVE-2026-08998.8Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruptionCVE-2026-09008.8Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruptioCVE-2026-09015.4Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing viCVE-2026-09028.8Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory readCVE-2026-09035.4Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous fCVE-2026-09045.4Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing viCVE-2026-09059.8Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to poteCVE-2026-09069.8Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URCVE-2026-09079.8Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HCVE-2026-09088.8Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a craftCVE-2026-09095.3The WP ULike plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.8.3.1. This is d
CVE-2026-0897: High severity, CVSS 7.5 | Vulnix