CVE-2026-9335: Improper Handling of HDF5 ExternalLinks in keras-team/keras
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.loadweights functions bypass the safegeth5group and safegeth5dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.loadweights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9335?
CVE-2026-9335 has a medium severity rating of 6.5.
How do I fix CVE-2026-9335?
To mitigate CVE-2026-9335, upgrade to keras version 3.14.1 or later.
What vulnerability does CVE-2026-9335 exploit?
CVE-2026-9335 exploits improper handling of HDF5 ExternalLinks in keras-team/keras.
What are the potential risks of CVE-2026-9335?
CVE-2026-9335 can lead to arbitrary local HDF5 file content disclosure.
In which versions of Keras is CVE-2026-9335 found?
CVE-2026-9335 affects keras-team/keras versions up to and including 3.14.0.