# Keras v3.12.4 — Keras 3.12.4

- Product: Keras (https://whatsnew.fyi/product/keras)
- Vendor: Keras
- Date: 2026-07-29
- Version: v3.12.4
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.12.4
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.12.4

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Restrict unpickling when loading IMDB and Reuters datasets to only permit numpy array reconstruction, preventing arbitrary code execution via crafted .npz files
- **security** — Verify all intermediary H5 groups when navigating H5 files to prevent potential path traversal
- **security** — Reject decompression-bomb members on the .keras asset extraction path by adding per-member decompression-ratio checks before extracting archives to disk
- **security** — Restrict unpickling when loading CIFAR datasets to block arbitrary code execution via pickle gadgets

#### Keras 3.12.4

Keras 3.12.4 is a security patch release that hardens dataset loading and model file handling against insecure deserialization and decompression-bomb attacks.

##### Security Fixes

* **Restrict unpickling when loading IMDB and Reuters datasets** — Replaces `np.load(allow_pickle=True)` with a restricted unpickler that only permits numpy array reconstruction, preventing arbitrary code execution via crafted `.npz` files (CWE-502). ([#23047](https://github.com/keras-team/keras/pull/23047)) by @LinZiyuu
* **Verify all intermediary H5 groups when navigating H5 files** — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal. ([#23168](https://github.com/keras-team/keras/pull/23168)) by @hertschuh
* **Reject decompression-bomb members on the `.keras` asset extraction path** — Adds per-member decompression-ratio checks before extracting `.keras` archives to disk, preventing disk-exhaustion attacks via crafted archives. ([#23101](https://github.com/keras-team/keras/pull/23101)) by @LinZiyuu
* **Restrict unpickling when loading CIFAR datasets** — Replaces bare `cPickle.load` in CIFAR-10/100 batch loading with the numpy-only `RestrictedUnpickler`, blocking arbitrary code execution via pickle gadgets. ([#23252](https://github.com/keras-team/keras/pull/23252)) by @SABITHSAHEB

---

##### Contributors

Thank you to all the contributors who made this release possible! 🎉

* @LinZiyuu — Security hardening for IMDB, Reuters, and `.keras` asset extraction ([#23047](https://github.com/keras-team/keras/pull/23047), [#23101](https://github.com/keras-team/keras/pull/23101))
* @hertschuh — H5 group verification ([#23168](https://github.com/keras-team/keras/pull/23168))
* @SABITHSAHEB — CIFAR dataset pickle restriction ([#23252](https://github.com/keras-team/keras/pull/23252))

---

**Full Changelog**: https://github.com/keras-team/keras/compare/v3.12.3...v3.12.4