Database/AI/ML frameworks & serving
Keras: unvalidated dataset sizes in .keras loading let a poisoned model exhaust node memory
Impact
keras.models.load_model() reads dataset shape and size fields out of a .keras archive without bounds-checking them, so a crafted file drives an unbounded allocation until the process is OOM-killed (exit 137). On a GPU node this is worse than a normal OOM: the loader typically runs in the same container that holds the GPU, so the kill takes down a worker that has already been scheduled onto an accelerator, and on a node without strict cgroup memory limits the allocation storm can push other pods on the box into reclaim. The exposure is a pipeline that ingests models from a public hub, a shared model registry, or tenant uploads. Keras states this bypasses the earlier fix for CVE-2026-0897, which only covered KerasFileEditor.
Who can reach it
Anyone who can place a .keras file where a serving or training job will load it - a public model hub, a shared registry, or a tenant model-upload path. No authentication to the node is needed; the victim process does the loading.
What to do
Upgrade Keras past 3.15.0 to a build containing commit 4933ea4a5b3fcc24ceacdc276f5bb5dfbd06756c and restart the serving or training workers that load models. No node drain or reboot is involved. Until then, treat model files as untrusted input: load only from registries you control, and run loaders under a hard cgroup memory limit so an OOM kills one worker instead of destabilising the node.
References
Related entries
- Feast operator: tenant-supplied feature repo code runs with elevated privileges, reaching cluster adminCVE-2026-18942 · Feast operator in Red Hat OpenShift AI (feature repository processing)Medium
- BentoML (bentoml build, symlink dereferencing in the build context): bentoml build follows symlinks inside the buildCVE-2026-40610 · BentoML (bentoml build, symlink dereferencing in the build context)Medium
- NVIDIA NemoClaw: sensitive information visible in process invocation leads to information disclosureCVE-2026-65088 · NVIDIA NemoClaw (process invocation exposing sensitive information)Medium
- Kubeflow (Pipelines UI): Stored XSS in the pipeline viewCVE-2024-9526 · Kubeflow (Pipelines UI)Medium
- TorchServe (model/workflow API): Information disclosure of files on the serving hostCVE-2023-48299 · TorchServe (model/workflow API)Medium
- llama.cpp (RPC backend): Arbitrary address read via `rpc_tensor.data`CVE-2024-42478 · llama.cpp (RPC backend)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.