v3.12.3
Security 14
- Prevent HDF5 external/soft links from being exploited to read arbitrary files during model editing
- Reject ExternalLink/SoftLink on legacy `.h5` dispatcher to extend HDF5 link rejection to the `load_weights` path
- Block HDF5 datasets that declare excessively large shapes to prevent out-of-memory crashes during `load_model`/`load_weights`
- Prevent virtual dataset references from being used to access external files in HDF5
- Block tar hard links whose target resolves outside the extraction root
- Detect and reject `.keras` archive members that declare far more data than is actually stored to prevent memory exhaustion
- Prevent symlink-based directory traversal attacks by resolving paths with `realpath` during extraction
- Validate npz weight members against shape and decompression bombs before allocating memory
- Ensure asset paths stay within the working directory during model saving and loading
- Apply Python's built-in tar extraction safety filter in `TarFile.extractall` on supported versions
- Close an insecure deserialization path in dataset utility functions
- Prevent pickle execution when loading NumPy weight files with `np.load`
- Make `Lambda` and `TorchModuleWrapper` `from_config` fail closed instead of silently allowing arbitrary code execution when `safe_mode` is unset
- Expand the list of APIs that should not be part of a deserialized model
Keras 3.12.3 is a security patch release that hardens model saving, loading, and deserialization against a range of attack vectors.
HDF5 Hardening
- Eject ExternalLink/SoftLink groups in KerasFileEditor (#22899)
- Prevents HDF5 external/soft links from being exploited to read arbitrary files during model editing.
- Reject ExternalLink/SoftLink on legacy
.h5dispatcher (#22900)- Extends HDF5 link rejection to the legacy
load_weightspath for.h5files.
- Extends HDF5 link rejection to the legacy
- Reject HDF5 shape-bomb datasets (#22975)
- Blocks HDF5 datasets that declare excessively large shapes to trigger out-of-memory crashes during
load_model/load_weights.
- Blocks HDF5 datasets that declare excessively large shapes to trigger out-of-memory crashes during
- Reject HDF5 virtual datasets in KerasFileEditor (#22976)
- Prevents virtual dataset references from being used to access external files.
Archive Hardening
- Reject hard-link tar members escaping extraction directory (#22973)
- Blocks tar hard links whose target resolves outside the extraction root.
- Reject decompression-bomb archive members (#23010)
- Detects and rejects
.kerasarchive members that declare far more data than is actually stored, preventing memory exhaustion.
- Detects and rejects
- Prevent symlink traversal during extraction (#23015)
- Resolves paths with
realpathto prevent symlink-based directory traversal attacks.
- Resolves paths with
- Reject npz weight bombs (#23016)
- Validates npz weight members against shape/decompression bombs before allocating memory.
- Validate DiskIOStore asset paths (#23017)
- Ensures asset paths stay within the working directory during model saving/loading.
- Use
filter="data"inTarFile.extractall(#23108)- Applies Python's built-in tar extraction safety filter on supported versions.
Deserialization Safety
- Fix insecure deserialization in dataset utilities (#23026)
- Closes an insecure deserialization path in dataset utility functions.
- Explicitly disable pickle in
np.load(#23034)- Prevents pickle execution when loading NumPy weight files.
- Make Lambda/TorchModuleWrapper
from_configfail closed (#23048)- When
safe_modeis unset,LambdaandTorchModuleWrapperdeserialization now fails closed instead of silently allowing arbitrary code execution.
- When
- Restrict reloadable APIs (#23115)
- Expands the list of APIs that should not be part of a deserialized model.
Full Changelog: https://github.com/keras-team/keras/compare/v3.12.2...v3.12.3