CVE-2026-12570

CVE-2026-12570 is a confirmed bypass of CVE-2026-0897 in Keras's H5 model loading subsystem. The original patch addressed KerasFileEditor but left H5IOStore.__getitem__ untouched—a textbook example of sibling vulnerability emergence when remediation is scoped to the reported proof-of-concept rather than auditing all code paths that touch the same underlying data structure. Both entry points deserialize unvalidated dataset metadata from .keras files, and the incomplete fix made H5IOStore the obvious next target for anyone monitoring CVE disclosures. The CVSS 5.5 rating misrepresents operational risk. Exit code 137 (OOM-killed process) in a shared ML serving cluster doesn't stay contained to one inference request—it can trigger pod evictions, corrupt stateful model caches shared across concurrent requests, and leave batch schedulers in inconsistent states. If your pipeline loads .keras artifacts from any registry, untrusted source, or internal model store, you are parsing attacker-controlled binary data with full memory privileges. The fact that CVE-2026-0897's fix can be bypassed means adversarial model poisoning now has a reliable DoS vector against any Keras <= 3.15.0 deployment. What to do: treat H5IOStore as actively vulnerable until you confirm the 3.16.x patch addresses dataset metadata validation at the store layer, not just at KerasFileEditor. Audit your model loading paths—if you use custom H5IOStore subclasses or direct h5py calls, those are independent attack surfaces that may not receive the same scrutiny. In production serving environments, consider isolating model loading into sandboxed processes with hard memory limits, because the parsing subsystem has now demonstrated multiple paths to uncontrolled allocation. The Keras team will patch this specific instance, but the pattern of CVE-bypass vulnerabilities in H5 deserialization is well-documented across TensorFlow, PyTorch, and other libraries—treat this as a structural class of risk, not a one-off incident.

Reviewed through automated stages and approved by a human before publication.