Keras versions up to 3.15.0 contain a flaw in the file loading routine that fails to bound the size of H5 datasets. A specially crafted .keras file can trigger an unbounded memory allocation during the load, causing an out‑of‑memory condition and terminating the process. The weakness corresponds to CWE‑770, which describes uncontrolled resource consumption leading to denial of service.

The vulnerable package is keras by the Keras Team. All releases with a version number less than or equal to 3.15.0 are affected, including the latest 3.15.0 release. No additional affected products are listed.

The CVSS score of 5.0 indicates a moderate severity for a DoS scenario. The EPSS score of 0.00128 indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely to involve a malicious .keras file obtained from public repositories or a compromised model registry; the attacker must supply the file to an environment that executes keras.models.load_model(). If executed, the process will be killed with exit code 137, disrupting any machine‑learning pipelines that rely on that process.