CVE-2026-21864 Details
Description
Valkey-Bloom is a Rust based Valkey module which brings a Bloom Filter (Module) data type into the Valkey distributed key-value database. Prior to commit a68614b6e3845777d383b3a513cedcc08b3b7ccd, a specially crafted `RESTORE` command can cause Valkey to hit an assertion, causes the server to shutdown. Valkey modules are required to handle errors in RDB parsing by using `VALKEYMODULE_OPTIONS_HANDLE_IO_ERRORS` flag. If this flag is not set, errors encountered during parsing result in a system assertion which shuts down the system. Even though the Valkey-bloom module correctly handled the parsing, it did not originally set the flag. Commit a68614b6e3845777d383b3a513cedcc08b3b7ccd contains a patch. One may mitigate this defect by disabling the `RESTORE` command if it is unused by one's application.
A denial-of-service vulnerability has been identified in the Valkey-Bloom module for the Valkey distributed key-value database, affecting versions through 1.0.1. The issue arises when a specially crafted 'RESTORE' command is sent, causing the Valkey server to hit an assertion and shut down. This problem occurs because Valkey modules must use the 'VALKEYMODULE_OPTIONS_HANDLE_IO_ERRORS' flag to manage errors during RDB parsing. If the flag is not set, parsing errors lead to a system assertion that crashes the server. While the Valkey-Bloom module properly handled RDB data parsing, it initially failed to activate the necessary error-handling flag. The vulnerability has been patched in version 1.0.1.
Users can upgrade to Valkey-Bloom version 1.0.1, which includes the necessary patch. If the update is not possible, the 'RESTORE' command can be disabled if it is not needed by the application.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lfprojects valkey-bloom | < 1.0.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 26, 2026 | Initial Analysis | [email protected] |
| Feb 24, 2026 | New CVE Received | [email protected] |