Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

keras

20 known vulnerabilities (2 critical, 11 high, 6 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
3.15.1 (Jul 29, 2026): no advisory affects it
Newest unaffected release
3.15.1 (Jul 29, 2026), the latest release
Advisories
20 · 2 critical, 11 high, 6 medium, 1 low
Weekly downloads
3.3M
Dependents
4,079
Releases
124 since 0.2.0 (Oct 11, 2015)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-12570
    Affects 0.2.0 to 3.14.1 (3.15.0 is outside it)
  • CVE-2026-9335
    Affects 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it)
  • CVE-2026-12484
    Affects 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it)
  • CVE-2026-12482
    Affects 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it)
  • CVE-2026-12481
    Affects 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it)
  • CVE-2026-12480
    Affects 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it)
  • CVE-2026-12479
    Affects 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it)
  • CVE-2026-11816
    Affects 0.2.0 to 3.13.2 (3.14.0 is outside it)
  • CVE-2026-1462
    Affects 0.2.0 to 3.13.1 (3.13.2 is outside it)
  • CVE-2026-1669
    Affects 3.0.0 to 3.12.0 (3.12.1 is outside it); 3.13.0 to 3.13.1 (3.13.2 is outside it)
  • CVE-2026-0897
    Affects 3.0.0 to 3.13.1 (3.13.2 is outside it)
  • CVE-2025-12060
    Affects 0.2.0 to 3.11.3 (3.12.0 is outside it)
Show all 20 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 20

  • CVE-2026-12570Medium 5.5

    Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras

    Affected: fixed in 3.15.0.

    Fixed in 3.15.0 (released Jun 24, 2026, 47 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • CVE-2026-9335Medium 6.5

    Improper Handling of HDF5 ExternalLinks in keras-team/keras

    Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0.

    Fixed in 3.12.3 (released Jun 26, 2026, 37 days before disclosure) and 3.15.0 (released Jun 24, 2026, 39 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config

    Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0.

    Fixed in 3.12.3 (released Jun 26, 2026, 23 days before disclosure) and 3.15.0 (released Jun 24, 2026, 25 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • Path Traversal via Symlink Name Validation Bypass in keras-team/keras

    Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0.

    Fixed in 3.12.3 (released Jun 26, 2026, 18 days before disclosure) and 3.15.0 (released Jun 24, 2026, 20 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • Deserialization of Untrusted Data in keras-team/keras

    Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0.

    Fixed in 3.12.3 (released Jun 26, 2026, 7 days before disclosure) and 3.15.0 (released Jun 24, 2026, 9 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • CVE-2026-12480Medium 5.5

    Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras

    Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0.

    Fixed in 3.12.3 (released Jun 26, 2026, 5 days before disclosure) and 3.15.0 (released Jun 24, 2026, 7 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • CVE-2026-12479Medium 6.1

    Path Traversal in keras-team/keras

    Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0.

    Fixed in 3.12.3 (released Jun 26, 2026, 4 days after disclosure) and 3.15.0 (released Jun 24, 2026, 2 days after disclosure).

    The latest release, 3.15.1, is not affected.

  • Path Traversal in keras-team/keras

    Affected: fixed in 3.14.0.

    Fixed in 3.14.0 (released Apr 3, 2026, 69 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • Safe Mode Bypass in keras-team/keras

    Affected: fixed in 3.13.2; fixed in 3.13.2.

    Fixed in 3.13.2 (released Jan 30, 2026, 73 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • Arbitrary File Read in Keras via HDF5 External Datasets

    Affected: from 3.0.0, fixed in 3.12.1; from 3.13.0, fixed in 3.13.2; from 3.13.0, fixed in 3.13.2; from 3.0.0, fixed in 3.12.1.

    Fixed in 3.12.1 (released Jan 30, 2026, 12 days before disclosure) and 3.13.2 (released Jan 30, 2026, 12 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

    Affected: from 3.0.0, fixed in 3.13.1; from 3.0.0, fixed in 3.12.1; from 3.13.0, fixed in 3.13.2.

    Fixed in 3.13.2 (released Jan 30, 2026, 15 days after disclosure).

    The latest release, 3.15.1, is not affected.

  • Keras keras.utils.get_file Utility Path Traversal Vulnerability

    Affected: fixed in 3.12.0.

    Fixed in 3.12.0 (released Oct 27, 2025, 3 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • CVE-2025-12058Medium 5.9

    Vulnerability in Keras Model.load_model Leading to Arbitrary Local File Loading and SSRF

    Affected: fixed in 3.12.0.

    Fixed in 3.12.0 (released Oct 27, 2025, 2 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • CVE-2025-49655Critical 9.8

    Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3…

    Affected: from 3.11.0, fixed in 3.11.3.

    Fixed in 3.11.3 (released Aug 21, 2025, 57 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • Arbitary Code execution in Keras load_model()

    Affected: from 3.0.0, fixed in 3.11.3.

    Fixed in 3.11.3 (released Aug 21, 2025, 29 days before disclosure).

    The latest release, 3.15.1, is not affected.

Show all 20 advisoriesShow fewer advisories

  • Arbitrary Code execution in Keras Safe Mode

    Affected: fixed in 3.11.0; version range not reported.

    Fixed in 3.11.0 (released Jul 30, 2025, 51 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.

    Affected: version range not reported; from 3.0.0, fixed in 3.11.0.

    Fixed in 3.11.0 (released Jul 30, 2025, 12 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • Arbitrary Code Execution via Crafted Keras Config for Model Loading

    Affected: from 3.0.0, fixed in 3.9.0; from 3.0.0, fixed in 3.8.0.

    Fixed in 3.9.0 (released Mar 4, 2025, 7 days before disclosure).

    The latest release, 3.15.1, is not affected.

  • CVE-2024-55459Medium 6.5

    An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the…

    Affected: through 3.7.0.

    Fixed in 3.8.0 (released Jan 7, 2025, 1 day before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.15.1, is not affected.

  • CVE-2024-3660Critical 9.8

    Arbitrary code injection vulnerability in Keras framework < 2.13

    Affected: fixed in 2.13.1rc0.

    Fixed in 2.13.1rc0 (released May 2, 2023, 350 days before disclosure).

    The latest release, 3.15.1, is not affected.