CVE-2025-9905: Keras safe_mode ignored for legacy .h5 models

In Keras 3.0.0 through 3.11.2, safe_mode=True was ignored when loading legacy .h5 models, so a Lambda layer's stored function ran on load (CVE-2025-9905). It is fixed in Keras 3.11.3, and a static scanner, hdf5_keras_lambda_scan from the keras-model-scan toolkit, checks old files without executing them.

• Affects Keras 3.0.0–3.11.2, fixed in 3.11.3
• Loading the .h5 file is enough to trigger it; no inference needed
• Scanner reads only file bytes and never imports h5py
• Distinct from CVE-2025-9906, a .keras ZIP bug fixed in 3.11.0