# Keras v3.12.3

- Product: Keras (https://whatsnew.fyi/product/keras)
- Vendor: Keras
- Date: 2026-06-26
- Version: v3.12.3
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.12.3
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.12.3

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Prevent HDF5 external/soft links from being exploited to read arbitrary files during model editing
- **security** — Reject ExternalLink/SoftLink on legacy `.h5` dispatcher to extend HDF5 link rejection to the `load_weights` path
- **security** — Block HDF5 datasets that declare excessively large shapes to prevent out-of-memory crashes during `load_model`/`load_weights`
- **security** — Prevent virtual dataset references from being used to access external files in HDF5
- **security** — Block tar hard links whose target resolves outside the extraction root
- **security** — Detect and reject `.keras` archive members that declare far more data than is actually stored to prevent memory exhaustion
- **security** — Prevent symlink-based directory traversal attacks by resolving paths with `realpath` during extraction
- **security** — Validate npz weight members against shape and decompression bombs before allocating memory
- **security** — Ensure asset paths stay within the working directory during model saving and loading
- **security** — Apply Python's built-in tar extraction safety filter in `TarFile.extractall` on supported versions
- **security** — Close an insecure deserialization path in dataset utility functions
- **security** — Prevent pickle execution when loading NumPy weight files with `np.load`
- **security** — Make `Lambda` and `TorchModuleWrapper` `from_config` fail closed instead of silently allowing arbitrary code execution when `safe_mode` is unset
- **security** — Expand the list of APIs that should not be part of a deserialized model

Keras 3.12.3 is a security patch release that hardens model saving, loading, and deserialization against a range of attack vectors.

##### HDF5 Hardening

* **Eject ExternalLink/SoftLink groups in KerasFileEditor** (#22899)
  * Prevents HDF5 external/soft links from being exploited to read arbitrary files during model editing.
* **Reject ExternalLink/SoftLink on legacy `.h5` dispatcher** (#22900)
  * Extends HDF5 link rejection to the legacy `load_weights` path for `.h5` files.
* **Reject HDF5 shape-bomb datasets** (#22975)
  * Blocks HDF5 datasets that declare excessively large shapes to trigger out-of-memory crashes during `load_model`/`load_weights`.
* **Reject HDF5 virtual datasets in KerasFileEditor** (#22976)
  * Prevents virtual dataset references from being used to access external files.

##### Archive Hardening

* **Reject hard-link tar members escaping extraction directory** (#22973)
  * Blocks tar hard links whose target resolves outside the extraction root.
* **Reject decompression-bomb archive members** (#23010)
  * Detects and rejects `.keras` archive members that declare far more data than is actually stored, preventing memory exhaustion.
* **Prevent symlink traversal during extraction** (#23015)
  * Resolves paths with `realpath` to prevent symlink-based directory traversal attacks.
* **Reject npz weight bombs** (#23016)
  * Validates npz weight members against shape/decompression bombs before allocating memory.
* **Validate DiskIOStore asset paths** (#23017)
  * Ensures asset paths stay within the working directory during model saving/loading.
* **Use `filter="data"` in `TarFile.extractall`** (#23108)
  * Applies Python's built-in tar extraction safety filter on supported versions.

##### Deserialization Safety

* **Fix insecure deserialization in dataset utilities** (#23026)
  * Closes an insecure deserialization path in dataset utility functions.
* **Explicitly disable pickle in `np.load`** (#23034)
  * Prevents pickle execution when loading NumPy weight files.
* **Make Lambda/TorchModuleWrapper `from_config` fail closed** (#23048)
  * When `safe_mode` is unset, `Lambda` and `TorchModuleWrapper` deserialization now fails closed instead of silently allowing arbitrary code execution.
* **Restrict reloadable APIs** (#23115)
  * Expands the list of APIs that should not be part of a deserialized model.

**Full Changelog**: https://github.com/keras-team/keras/compare/v3.12.2...v3.12.3