Downloads · 30 days
0
keras-load-model-extra-zip-member-disk-dos-poc-20260708
htdy7703/keras-load-model-extra-zip-member-disk-dos-poc-20260708
keras-load-model-extra-zip-member-disk-dos-poc-20260708 is a machine learning model from htdy7703. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
This PoC shows that Keras' default keras.models.loadmodel() path extracts attacker-controlled extra ZIP members to a temporary directory when a .keras archive has more than three members, even if:
Access
Public
Updated Jul 8, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
.py2.4 KB · 48%
At a glance
- Access
- Public
- Created
- Jul 8, 2026
- Updated
- Jul 8, 2026
- SHA
- 9b96a9ad
Model card
From the Hugging Face model README
Keras .keras extra ZIP member disk-exhaustion PoC
This PoC shows that Keras' default keras.models.load_model() path extracts
attacker-controlled extra ZIP members to a temporary directory when a .keras
archive has more than three members, even if:
- the model uses no asset-loading layers
- the extra member is not under
assets/ - the model otherwise loads successfully
What this PoC proves:
- a tiny
.kerasarchive can hide a much larger extra member such asjunk.bin load_model()writes that hidden member to disk before returning the model- the work and disk usage scale with the uncompressed hidden payload
What this PoC does not claim:
- remote code execution
- arbitrary-path file write
- arbitrary file read
Verified runtime:
- Keras
3.16.0 - TensorFlow CPU
2.21.0 - source commit
2aeecf06e0dc6886d962d14f8056f7ca8b15792b
Run repro.py with the built Keras package on PYTHONPATH. The script builds
a legitimate .keras model, appends a compressed junk.bin member outside the
assets/ tree, and measures the resulting load_model() behavior.
- Created
- Jul 8, 2026
- Updated
- Jul 8, 2026