Rust Based Valkey Module Vulnerability in Valkey Distributed Key-Value Database
CVE-2026-21864

6.5MEDIUM

Key Information:

Vendor

Valkey-io

Status
Valkey-bloom
Vendor
CVE Published:
24 February 2026

What is CVE-2026-21864?

The Valkey Bloom module, a Rust-based component of the Valkey distributed key-value database, contains a vulnerability that can lead to a server shutdown when a specially crafted RESTORE command is executed. This issue arises due to the module failing to set the error handling flag VALKEYMODULE_OPTIONS_HANDLE_IO_ERRORS during RDB parsing. As a result, encountering parsing errors triggers an assertion failure, causing the server to crash. To address this vulnerability, users can either update to the patched version or disable the RESTORE command if it is not being utilized in their applications. For further details, refer to the official advisory and commit documentation.

Affected Version(s)

valkey-bloom < a68614b6e3845777d383b3a513cedcc08b3b7ccd

References

https://github.com/valkey-io/valkey-bloom/security/adviso...
x_refsource_CONFIRM
https://github.com/valkey-io/valkey-bloom/commit/a68614b6...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.