THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-9335 (MEDIUM 6.5) — A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` help

[NVD] CVE-2026-9335 (MEDIUM 6.5) — A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` help

mednvdPublished 2026-08-02

CVE-2026-9335 CVSS: 6.5 MEDIUM Published: 2026-08-02T05:16:20.827

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and S

Indicators of compromise

CVE-2026-9335cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-9335