# keras (PyPI) vulnerabilities 20 known vulnerabilities (2 critical, 11 high, 6 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.15.1 (Jul 29, 2026): no advisory affects it - Newest unaffected release: 3.15.1 (Jul 29, 2026), the latest release - Weekly downloads: 3.3M - Dependents: 4,079 - Releases: 124 since 0.2.0 (Oct 11, 2015) - Registry: https://pypi.org/project/keras/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-12570: 0.2.0 to 3.14.1 (3.15.0 is outside it) - CVE-2026-9335: 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it) - CVE-2026-12484: 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it) - CVE-2026-12482: 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it) - CVE-2026-12481: 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it) - CVE-2026-12480: 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it) - CVE-2026-12479: 0.2.0 to 3.12.2 (3.12.3 is outside it); 3.13.0 to 3.14.1 (3.15.0 is outside it) - CVE-2026-11816: 0.2.0 to 3.13.2 (3.14.0 is outside it) - CVE-2026-1462: 0.2.0 to 3.13.1 (3.13.2 is outside it) - CVE-2026-1669: 3.0.0 to 3.12.0 (3.12.1 is outside it); 3.13.0 to 3.13.1 (3.13.2 is outside it) - CVE-2026-0897: 3.0.0 to 3.13.1 (3.13.2 is outside it) - CVE-2025-12060: 0.2.0 to 3.11.3 (3.12.0 is outside it) - CVE-2025-12058: 0.2.0 to 3.11.3 (3.12.0 is outside it) - CVE-2025-49655: 3.11.0 to 3.11.2 (3.11.3 is outside it) - CVE-2025-9905: 3.0.0 to 3.11.2 (3.11.3 is outside it) - CVE-2025-9906: 0.2.0 to 3.10.0 (3.11.0 is outside it) - CVE-2025-8747: 3.0.0 to 3.10.0 (3.11.0 is outside it) - CVE-2025-1550: 3.0.0 to 3.8.0 (3.9.0 is outside it) - CVE-2024-55459: 0.2.0 to 3.7.0 (3.8.0 is outside it) - CVE-2024-3660: 0.2.0 to 2.12.0 (2.13.1rc0 is outside it) ## Advisories (20) ### [CVE-2026-12570](https://cve.now/CVE-2026-12570): Denial of Service via HDF5 Shape Bomb in keras.models.load\_model() in keras-team/keras - Severity: Medium 5.5 - Published: Aug 10, 2026 - Affected: fixed in 3.15.0. - Fixed in 3.15.0 (released Jun 24, 2026, 47 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2026-9335](https://cve.now/CVE-2026-9335): Improper Handling of HDF5 ExternalLinks in keras-team/keras - Severity: Medium 6.5 - Published: Aug 2, 2026 - Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0. - Fixed in 3.12.3 (released Jun 26, 2026, 37 days before disclosure) and 3.15.0 (released Jun 24, 2026, 39 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2026-12484](https://cve.now/CVE-2026-12484): Unsafe Deserialization in keras.layers.TorchModuleWrapper.from\_config - Severity: High 7.8 - Published: Jul 19, 2026 - Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0. - Fixed in 3.12.3 (released Jun 26, 2026, 23 days before disclosure) and 3.15.0 (released Jun 24, 2026, 25 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2026-12482](https://cve.now/CVE-2026-12482): Path Traversal via Symlink Name Validation Bypass in keras-team/keras - Severity: Low 3.1 - Published: Jul 14, 2026 - Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0. - Fixed in 3.12.3 (released Jun 26, 2026, 18 days before disclosure) and 3.15.0 (released Jun 24, 2026, 20 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2026-12481](https://cve.now/CVE-2026-12481): Deserialization of Untrusted Data in keras-team/keras - Severity: High 8.8 - Published: Jul 3, 2026 - Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0. - Fixed in 3.12.3 (released Jun 26, 2026, 7 days before disclosure) and 3.15.0 (released Jun 24, 2026, 9 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2026-12480](https://cve.now/CVE-2026-12480): Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras - Severity: Medium 5.5 - Published: Jul 1, 2026 - Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0. - Fixed in 3.12.3 (released Jun 26, 2026, 5 days before disclosure) and 3.15.0 (released Jun 24, 2026, 7 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2026-12479](https://cve.now/CVE-2026-12479): Path Traversal in keras-team/keras - Severity: Medium 6.1 - Published: Jun 22, 2026 - Affected: fixed in 3.12.3; from 3.13.0, fixed in 3.15.0; fixed in 3.12.3; from 3.13.0, fixed in 3.15.0. - Fixed in 3.12.3 (released Jun 26, 2026, 4 days after disclosure) and 3.15.0 (released Jun 24, 2026, 2 days after disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2026-11816](https://cve.now/CVE-2026-11816): Path Traversal in keras-team/keras - Severity: High 8.1 - Published: Jun 11, 2026 - Affected: fixed in 3.14.0. - Fixed in 3.14.0 (released Apr 3, 2026, 69 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2026-1462](https://cve.now/CVE-2026-1462): Safe Mode Bypass in keras-team/keras - Severity: High 8.8 - Published: Apr 13, 2026 - Affected: fixed in 3.13.2; fixed in 3.13.2. - Fixed in 3.13.2 (released Jan 30, 2026, 73 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2026-1669](https://cve.now/CVE-2026-1669): Arbitrary File Read in Keras via HDF5 External Datasets - Severity: High 7.1 - Published: Feb 11, 2026 - Affected: from 3.0.0, fixed in 3.12.1; from 3.13.0, fixed in 3.13.2; from 3.13.0, fixed in 3.13.2; from 3.0.0, fixed in 3.12.1. - Fixed in 3.12.1 (released Jan 30, 2026, 12 days before disclosure) and 3.13.2 (released Jan 30, 2026, 12 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2026-0897](https://cve.now/CVE-2026-0897): Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata - Severity: High 7.1 - Published: Jan 15, 2026 - Affected: from 3.0.0, fixed in 3.13.1; from 3.0.0, fixed in 3.12.1; from 3.13.0, fixed in 3.13.2. - Fixed in 3.13.2 (released Jan 30, 2026, 15 days after disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2025-12060](https://cve.now/CVE-2025-12060): Keras keras.utils.get\_file Utility Path Traversal Vulnerability - Severity: High 8.9 - Published: Oct 30, 2025 - Affected: fixed in 3.12.0. - Fixed in 3.12.0 (released Oct 27, 2025, 3 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2025-12058](https://cve.now/CVE-2025-12058): Vulnerability in Keras Model.load\_model Leading to Arbitrary Local File Loading and SSRF - Severity: Medium 5.9 - Published: Oct 29, 2025 - Affected: fixed in 3.12.0. - Fixed in 3.12.0 (released Oct 27, 2025, 2 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2025-49655](https://cve.now/CVE-2025-49655): Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3… - Severity: Critical 9.8 - Published: Oct 17, 2025 - Affected: from 3.11.0, fixed in 3.11.3. - Fixed in 3.11.3 (released Aug 21, 2025, 57 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2025-9905](https://cve.now/CVE-2025-9905): Arbitary Code execution in Keras load\_model() - Severity: High 7.3 - Published: Sep 19, 2025 - Affected: from 3.0.0, fixed in 3.11.3. - Fixed in 3.11.3 (released Aug 21, 2025, 29 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2025-9906](https://cve.now/CVE-2025-9906): Arbitrary Code execution in Keras Safe Mode - Severity: High 8.6 - Published: Sep 19, 2025 - Affected: fixed in 3.11.0; version range not reported. - Fixed in 3.11.0 (released Jul 30, 2025, 51 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2025-8747](https://cve.now/CVE-2025-8747): Keras safe\_mode bypass allows arbitrary code execution when loading a malicious model. - Severity: High 8.6 - Published: Aug 11, 2025 - Affected: version range not reported; from 3.0.0, fixed in 3.11.0. - Fixed in 3.11.0 (released Jul 30, 2025, 12 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2025-1550](https://cve.now/CVE-2025-1550): Arbitrary Code Execution via Crafted Keras Config for Model Loading - Severity: High 7.3 - Published: Mar 11, 2025 - Affected: from 3.0.0, fixed in 3.9.0; from 3.0.0, fixed in 3.8.0. - Fixed in 3.9.0 (released Mar 4, 2025, 7 days before disclosure). - The latest release, 3.15.1, is not affected. ### [CVE-2024-55459](https://cve.now/CVE-2024-55459): An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the… - Severity: Medium 6.5 - Published: Jan 8, 2025 - Affected: through 3.7.0. - Fixed in 3.8.0 (released Jan 7, 2025, 1 day before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.15.1, is not affected. ### [CVE-2024-3660](https://cve.now/CVE-2024-3660): Arbitrary code injection vulnerability in Keras framework \< 2.13 - Severity: Critical 9.8 - Published: Apr 16, 2024 - Affected: fixed in 2.13.1rc0. - Fixed in 2.13.1rc0 (released May 2, 2023, 350 days before disclosure). - The latest release, 3.15.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/keras Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.