CVE-2026-21864: Remote DoS from malformed RESTORE command

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-24 · updated 2026-06-17
Weakness: CWE-20

Description

Valkey-Bloom is a Rust based Valkey module which brings a Bloom Filter (Module) data type into the Valkey distributed key-value database. Prior to commit a68614b6e3845777d383b3a513cedcc08b3b7ccd, a specially crafted `RESTORE` command can cause Valkey to hit an assertion, causes the server to shutdown. Valkey modules are required to handle errors in RDB parsing by using `VALKEYMODULE_OPTIONS_HANDLE_IO_ERRORS` flag. If this flag is not set, errors encountered during parsing result in a system assertion which shuts down the system. Even though the Valkey-bloom module correctly handled the parsing, it did not originally set the flag. Commit a68614b6e3845777d383b3a513cedcc08b3b7ccd contains a patch. One may mitigate this defect by disabling the `RESTORE` command if it is unused by one's application.

Affected products

valkey-io valkey-bloom: before 1.0.1 — fixed in 1.0.1

How to fix

Upgrade to a fixed version: valkey-io valkey-bloom 1.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-21864 or the next vulnerability affects your stack