CVE-2026-21864

CVE-2026-21864 describes a vulnerability in the Valkey-Bloom module for the Valkey distributed key-value database, affecting versions prior to commit a68614b6e3845777d383b3a513cedcc08b3b7ccd. A specially crafted RESTORE command can trigger an assertion failure, leading to a server shutdown. This issue stems from the module's failure to set the VALKEYMODULE_OPTIONS_HANDLE_IO_ERRORS flag, which is required for proper RDB parsing error handling. Rated with a CVSS score of 7.5 (High), this vulnerability has a network attack vector and low attack complexity, allowing an unauthenticated attacker to cause a denial of service (server shutdown). While the impact is limited to availability, the ease of exploitation makes it a significant concern. Mitigation involves updating to the patched version or disabling the RESTORE command if unused. Currently, there is no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or Nuclei modules. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of reported vulnerabilities.