TensorFlow HDF5 Security Research PoCs

This repository contains proof-of-concept .h5 model files for an authorized security audit under the huntr Model Format Vulnerability program (beta). These artifacts are for defensive validation and coordinated disclosure only, not for any production or general-purpose use.

Summary

The bundle currently contains three independent PoCs against TensorFlow's legacy Keras HDF5 loading path in the audited source tree (1d0f0c1c525442f9bb0e219ea4714ff94e56b374):

legacy_lambda_rce.h5
- Demonstrates benign load-time code execution by writing a fixed marker file in /tmp.
cyclic_inbound_nodes_dos.h5
- Demonstrates a load-time hang from cyclic Functional graph replay.
oversized_weight_allocation_dos.h5
- Demonstrates load-time allocation pressure from a tiny HDF5 file with a huge declared logical tensor.

Files

legacy_lambda_rce.h5, legacy_lambda_rce.py, legacy_lambda_rce_clean_repro.txt
cyclic_inbound_nodes_dos.h5, cyclic_inbound_nodes_dos.py, cyclic_inbound_nodes_dos_repro.txt
oversized_weight_allocation_dos.h5, oversized_weight_allocation_dos.py, oversized_weight_allocation_dos_repro.txt

Reproduction

Tested on July 29, 2026.

Run each PoC through the public tf.keras.models.load_model() API from a network-disabled container with:

TF_USE_LEGACY_KERAS=1 python3 <poc_script.py> <mode>

Where:

legacy_lambda_rce.py generates and reproduces in one run,
cyclic_inbound_nodes_dos.py uses generate and repro modes,
oversized_weight_allocation_dos.py uses generate and repro modes.

Note

These artifacts are intended only for defensive validation and coordinated disclosure workflows.