keras (PyPI)
Advisories
56
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.15.0 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "keras>=3.15.0"poetry
poetry add "keras>=3.15.0"uv
uv add "keras>=3.15.0"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-74m6-m3xx-3vmj Keras model loading is vulnerable to denial of service through HDF5 shape bombs |
Medium EPSS 0.19% |
< 3.15.0 | 3.15.0 |
| GHSA-74m6-m3xx-3vmj Keras model loading is vulnerable to denial of service through HDF5 shape bombs |
Medium EPSS 0.19% |
< 3.15.0 | 3.15.0 |
| GHSA-m8wh-29wm-52mv Keras: HDF5 links can disclose local file contents |
Medium EPSS 0.77% |
< 3.12.3>= 3.13.0, < 3.15.0 | 3.12.33.15.0 |
| GHSA-m8wh-29wm-52mv Keras: HDF5 links can disclose local file contents |
Medium EPSS 0.77% |
< 3.12.3 | 3.12.3 |
| GHSA-m8wh-29wm-52mv Keras: HDF5 links can disclose local file contents |
Medium EPSS 0.77% |
>= 3.13.0, < 3.15.0 | 3.15.0 |
| GHSA-v2w2-w228-c444 Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data |
High EPSS 0.30% |
< 3.12.3 | 3.12.3 |
| GHSA-v2w2-w228-c444 Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data |
High EPSS 0.30% |
>= 3.13.0, < 3.15.0 | 3.15.0 |
| GHSA-v2w2-w228-c444 Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data |
High EPSS 0.30% |
< 3.12.3>= 3.13.0, < 3.15.0 | 3.12.33.15.0 |
| GHSA-58hv-7753-xmfq Keras: tar extraction permits symlink-based path traversal |
Medium EPSS 0.33% |
< 3.12.3>= 3.13.0, < 3.15.0 | 3.12.33.15.0 |
| GHSA-58hv-7753-xmfq Keras: tar extraction permits symlink-based path traversal |
Medium EPSS 0.33% |
< 3.12.3 | 3.12.3 |
| GHSA-58hv-7753-xmfq Keras: tar extraction permits symlink-based path traversal |
Medium EPSS 0.33% |
>= 3.13.0, < 3.15.0 | 3.15.0 |
| GHSA-5gwj-m78q-7pq3 Keras: Lambda deserialization can bypass safe mode and execute code |
Critical EPSS 0.72% |
< 3.12.3 | 3.12.3 |
| GHSA-5gwj-m78q-7pq3 Keras: Lambda deserialization can bypass safe mode and execute code |
Critical EPSS 0.72% |
>= 3.13.0, < 3.15.0 | 3.15.0 |
| GHSA-5gwj-m78q-7pq3 Keras: Lambda deserialization can bypass safe mode and execute code |
Critical EPSS 0.72% |
< 3.12.3>= 3.13.0, < 3.15.0 | 3.12.33.15.0 |
| GHSA-26c4-7vv6-867j Keras: HDF5 virtual datasets can disclose local files |
Medium EPSS 0.19% |
< 3.12.3 | 3.12.3 |
| GHSA-26c4-7vv6-867j Keras: HDF5 virtual datasets can disclose local files |
Medium EPSS 0.19% |
>= 3.13.0, < 3.15.0 | 3.15.0 |
| GHSA-26c4-7vv6-867j Keras: HDF5 virtual datasets can disclose local files |
Medium EPSS 0.19% |
< 3.12.3>= 3.13.0, < 3.15.0 | 3.12.33.15.0 |
| GHSA-gh82-f9x8-5frx Keras: DiskIOStore permits path traversal through crafted layer names |
Medium EPSS 0.36% |
< 3.12.3 | 3.12.3 |
| GHSA-gh82-f9x8-5frx Keras: DiskIOStore permits path traversal through crafted layer names |
Medium EPSS 0.36% |
>= 3.13.0, < 3.15.0 | 3.15.0 |
| GHSA-gh82-f9x8-5frx Keras: DiskIOStore permits path traversal through crafted layer names |
Medium EPSS 0.36% |
< 3.12.3>= 3.13.0, < 3.15.0 | 3.12.33.15.0 |
| GHSA-hqp4-2352-xf5r Keras archive extraction utilities allow path traversal and arbitrary file writes |
High EPSS 0.56% |
< 3.14.0 | 3.14.0 |
| GHSA-hqp4-2352-xf5r Keras archive extraction utilities allow path traversal and arbitrary file writes |
High EPSS 0.56% |
< 3.14.0 | 3.14.0 |
| GHSA-4f3f-g24h-fr8m Keras has an untrusted deserialization vulnerability |
High EPSS 0.40% |
< 3.13.2 | 3.13.2 |
| GHSA-4f3f-g24h-fr8m Keras has an untrusted deserialization vulnerability |
High EPSS 0.40% |
< 3.13.2 | 3.13.2 |
| GHSA-gfmx-qqqh-f38q Duplicate Advisory: Keras vulnerable to arbitrary file read in the model loading mechanism (HDF5 integration) Withdrawn |
High | >= 3.0.0, <= 3.13.1 | No fix yet |
| GHSA-3m4q-jmj6-r34q Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading |
High EPSS 0.33% |
>= 3.0.0, < 3.12.1>= 3.13.0, < 3.13.2 | 3.12.13.13.2 |
| GHSA-3m4q-jmj6-r34q Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading |
High EPSS 0.33% |
>= 3.0.0, < 3.12.1 | 3.12.1 |
| GHSA-3m4q-jmj6-r34q Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading |
High EPSS 0.33% |
>= 3.13.0, < 3.13.2 | 3.13.2 |
| GHSA-xfhx-r7ww-5995 Duplicate Advisory: Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component Withdrawn |
High | >= 3.13.0, < 3.13.2 | 3.13.2 |
| GHSA-xfhx-r7ww-5995 Duplicate Advisory: Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component Withdrawn |
High | >= 3.0.0, < 3.12.1 | 3.12.1 |
| GHSA-mgx6-5cf9-rr43 Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor) |
High EPSS 0.33% |
>= 3.0.0, < 3.13.1 | 3.13.1 |
| GHSA-mgx6-5cf9-rr43 Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor) |
High EPSS 0.33% |
>= 3.13.0, < 3.13.2 | 3.13.2 |
| GHSA-mgx6-5cf9-rr43 Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor) |
High EPSS 0.33% |
>= 3.0.0, < 3.12.1 | 3.12.1 |
| GHSA-9g7v-8wxv-mwxp Duplicate Advisory: Keras keras.utils.get_file API is vulnerable to a path traversal attack Withdrawn |
High EPSS 0.71% |
< 3.12.0 | 3.12.0 |
| GHSA-28jp-44vh-q42h Duplicate Advisory: Keras keras.utils.get_file API is vulnerable to a path traversal attack Withdrawn |
High | < 3.12.0 | 3.12.0 |
| GHSA-hjqc-jx6g-rwp9 Keras Directory Traversal Vulnerability |
Critical EPSS 0.63% |
< 3.12.0 | 3.12.0 |
| GHSA-hjqc-jx6g-rwp9 Keras Directory Traversal Vulnerability |
Critical EPSS 0.63% |
< 3.12.0 | 3.12.0 |
| GHSA-mq84-hjqx-cwf2 Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery |
Medium EPSS 0.25% |
< 3.12.0 | 3.12.0 |
| GHSA-mq84-hjqx-cwf2 Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery |
Medium EPSS 0.25% |
< 3.12.0 | 3.12.0 |
| GHSA-cvhh-q5g5-qprp Keras framework vulnerable to deserialization of untrusted data |
Critical EPSS 0.75% |
>= 3.11.0, < 3.11.3 | 3.11.3 |
| GHSA-cvhh-q5g5-qprp Keras framework vulnerable to deserialization of untrusted data |
Critical EPSS 0.75% |
>= 3.11.0, < 3.11.3 | 3.11.3 |
| GHSA-77wq-646f-jrm2 Duplicate Advisory: The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded. Withdrawn |
High | >= 3.0.0, < 3.11.3 | 3.11.3 |
| GHSA-36fq-jgmw-4r9c Keras is vulnerable to Deserialization of Untrusted Data |
High EPSS 0.20% |
< 3.11.0 | 3.11.0 |
| GHSA-36fq-jgmw-4r9c Keras is vulnerable to Deserialization of Untrusted Data |
High EPSS 0.20% |
No fix yet | |
| GHSA-36rr-ww3j-vrjv The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded. |
High EPSS 0.22% |
>= 3.0.0, < 3.11.3 | 3.11.3 |
| GHSA-36rr-ww3j-vrjv The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded. |
High EPSS 0.22% |
>= 3.0.0, < 3.11.3 | 3.11.3 |
| GHSA-pwq7-2gvj-vg9v Duplicate Advisory: Keras safe mode bypass vulnerability Withdrawn |
High | >= 3.0.0, < 3.11.0 | 3.11.0 |
| GHSA-c9rc-mg46-23w3 Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality |
High EPSS 0.12% |
No fix yet | |
| GHSA-c9rc-mg46-23w3 Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality |
High EPSS 0.12% |
>= 3.0.0, < 3.11.0 | 3.11.0 |
| GHSA-5478-v2w6-c6q7 Duplicate Advisory: Keras arbitrary code execution vulnerability Withdrawn |
High | < 3.9.0 | 3.9.0 |
| GHSA-48g7-3x6r-xfhp Arbitrary Code Execution via Crafted Keras Config for Model Loading |
Critical EPSS 2.63% |
>= 3.0.0, < 3.9.0 | 3.9.0 |
| GHSA-48g7-3x6r-xfhp Arbitrary Code Execution via Crafted Keras Config for Model Loading |
Critical EPSS 2.63% |
>= 3.0.0, < 3.8.0 | 3.8.0 |
| GHSA-cjgq-5qmw-rcj6 keras Path Traversal vulnerability |
Medium EPSS 0.24% |
<= 3.7.0 | No fix yet |
| GHSA-cjgq-5qmw-rcj6 keras Path Traversal vulnerability |
Medium EPSS 0.24% |
<= 3.7.0 | No fix yet |
| GHSA-x4wf-678h-2pmq Keras code injection vulnerability |
Critical EPSS 1.75% |
< 2.13.1rc0 | 2.13.1rc0 |
| GHSA-x4wf-678h-2pmq Keras code injection vulnerability |
Critical EPSS 1.75% |
< 2.13.1rc0 | 2.13.1rc0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor