CVE-2026-21864

Valkey-Bloom is a Rust based Valkey module which brings a Bloom Filter (Module) data type into the Valkey distributed key-value database. Prior to commit a68614b6e3845777d383b3a513cedcc08b3b7ccd, a specially crafted `RESTORE` command can cause Valkey to hit an assertion, causes the server to shutdown. Valkey modules are required to handle errors in RDB parsing by using `VALKEYMODULE_OPTIONS_HANDLE_IO_ERRORS` flag. If this flag is not set, errors encountered during parsing result in a system assertion which shuts down the system. Even though the Valkey-bloom module correctly handled the parsing, it did not originally set the flag. Commit a68614b6e3845777d383b3a513cedcc08b3b7ccd contains a patch. One may mitigate this defect by disabling the `RESTORE` command if it is unused by one's application.

• CWE-20

• https://github.com/valkey-io/valkey-bloom/commit/a68614b6e3845777d383b3a513cedcc08b3b7ccdPatch
• https://github.com/valkey-io/valkey-bloom/security/advisories/GHSA-mc2g-h759-3qw2Vendor Advisory

Published

Feb 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21859Mailpit is an email testing tool and API for developers. Ver…5.3
• CVE-2026-2186A vulnerability has been found in Tenda RX3 16.03.13.11. Imp…8.8
• CVE-2026-21860Werkzeug is a comprehensive WSGI web application library. Pr…5.3
• CVE-2026-21861baserCMS is a website development framework. Prior to versio…7.2
• CVE-2026-21862RustFS is a distributed object storage system built in Rust.…7.5
• CVE-2026-21863Valkey is a distributed key-value database. Prior to version…7.5
• CVE-2026-21865Discourse is an open source discussion platform. In versions…6.5
• CVE-2026-21866Dify is an open-source LLM app development platform. Prior t…5.4
• CVE-2026-21867Rejected reason: Reason: This candidate was issued in error.
• CVE-2026-21868Flag Forge is a Capture The Flag (CTF) platform. Versions 2.…7.5
• CVE-2026-21869llama.cpp is an inference of several LLM models in C/C++. In…9.8
• CVE-2026-2187A vulnerability was found in Tenda RX3 16.03.13.11. The affe…8.8