AIKIDO-2026-408481

TL;DR

Affected versions of keras guard .keras archives against decompression bombs only on the in-memory reads of config.json, model.weights.h5, and the sharded weight map. When an archive has more than three members, keras.saving.load_model builds a disk-backed DiskIOStore that extracts every ZIP member with ZipFile.extractall, with path-traversal filtering but no per-member decompression-ratio check. An attacker-added member that decompresses far beyond its stored size can therefore write hundreds of MB to GB to disk from a small archive under the default safe_mode=True, exhausting disk space and denying service. The fix adds _reject_zip_extract_bomb, which rejects members whose declared-to-stored size ratio exceeds the threshold before extraction.