Beta

Explore
Marketplace
Neural Labs
Chat
Wallet
Docs

Beta

Explore Marketplace Neural Labs Wallet Docs

Build

Manage

My assets Manage wallet Organization

Community

Discord X (Twitter)Telegram

Docs Privacy Policy Terms and Conditions

Proud member of

Proud member of

Docs Cookie Policy

Privacy Policy Terms and Conditions

© 2026 AlphaNeural AI. All rights reserved.

keras-npz-root-member-memory-dos-poc-20260707 – AI Model by htdy7703 | AlphaNeural AI

You can deploy this model and start earning money today!

htdy7703/
keras-npz-root-member-memory-dos-poc-20260707

like

0

Views

No views yet

Keras `.keras` NPZ Root Member DoS PoC

This repository contains a minimal proof of concept for a denial-of-service issue in Keras native .keras loading.

What it shows:

a crafted .keras archive can carry model.weights.npz
the root NPZ member __root__.npy is materialized before Keras applies the existing NPZ bomb guard used for named members
keras.saving.load_model() can therefore allocate attacker-controlled memory from a small archive before failing

What it does not show:

remote code execution
filesystem access
SSRF
a bug in the default public keras.saving.save_model() output path

Files

2026-07-07-npz-root-bomb-poc.py: builds a legitimate base archive, replaces the weights with a crafted NPZ payload, calls the public keras.saving.load_model() loader, and measures the RSS increase during load

The script generates the malicious .keras archive during execution, so a prebuilt binary payload is not required to reproduce the issue.

Verified Runtime

keras 3.16.0
TensorFlow CPU 2.21.0

Example

bash

PYTHONPATH=/path/to/built/keras:/path/to/runtime/deps \
KERAS_BACKEND=tensorflow \
python3 2026-07-07-npz-root-bomb-poc.py