Every CVE Search/ Get API key

CVE-2026-9335

Improper Handling of HDF5 ExternalLinks in keras-team/keras

6.5 MediumPublic exploitFix available

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.77%Up 0.1 points since Aug 2, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Improper Handling of HDF5 ExternalLinks in keras-team/keras

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

Record
CVE-2026-9335
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-51922 6.5

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

Record
EUVD-2026-51922
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-m8wh-29wm-52mv 6.5

Keras: HDF5 links can disclose local file contents

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

Record
GHSA-m8wh-29wm-52mv
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 6.5

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

Record
CVE-2026-9335
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 6.5

Improper Handling of HDF5 ExternalLinks in keras-team/keras

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

Record
CVE-2026-9335
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVDEBIAN-CVE-2026-9335 6.5

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

Record
DEBIAN-CVE-2026-9335
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-m8wh-29wm-52mv 6.5

Keras: HDF5 links can disclose local file contents

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

Record
GHSA-m8wh-29wm-52mv
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVPYSEC-2026-3633 6.5

Keras: HDF5 links can disclose local file contents

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

Record
PYSEC-2026-3633
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-9335 6.5

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

Record
UBUNTU-CVE-2026-9335
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keras
PyPI
 before 3.12.3
3.12.3
keras
PyPI
 3.13.0 up to 3.15.0
3.15.0
keras
Debian:11
 All versions, plus listed versions
2.3.1+dfsg-32.3.1+dfsg2-1
 None known
keras
PyPI
 before 3.12.3, plus listed versions
0.2.00.3.00.3.10.3.20.3.3
Show 45 moreShow less
1.0.01.0.11.0.21.0.31.0.41.0.51.0.61.0.71.0.81.1.01.1.11.1.21.2.01.2.11.2.22.0.02.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.12.1.22.1.32.1.42.1.52.1.62.10.02.10.0rc02.10.0rc12.11.02.11.0rc02.11.0rc12.11.0rc22.11.0rc32.12.02.12.0rc02.12.0rc12.13.12.13.1rc0
3.12.3
keras
PyPI
 3.13.0 up to 3.15.0, plus listed versions
3.13.13.13.23.14.03.14.1
3.15.0
keras
PyPI
 before 3.12.3, 3.13.0 up to 3.15.0, plus listed versions
0.2.00.3.00.3.10.3.20.3.3
Show 45 moreShow less
1.0.01.0.11.0.21.0.31.0.41.0.51.0.61.0.71.0.81.1.01.1.11.1.21.2.01.2.11.2.22.0.02.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.12.1.22.1.32.1.42.1.52.1.62.10.02.10.0rc02.10.0rc12.11.02.11.0rc02.11.0rc12.11.0rc22.11.0rc32.12.02.12.0rc02.12.0rc12.13.12.13.1rc0
3.12.33.15.0
keras
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.0.7-22.1.1-1
 None known
keras
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.2.4-1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubpaparojonathan/CVE-2026-9335-keras-hdf5-externallink2026-09-02

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9335 is a medium vulnerability (CVSS 6.5) in Keras-team Keras-team/keras, published August 2, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in keras 3.12.3.

References

Show 9 moreShow less
This page doesn't list everything

Left out here: 134 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open