The Valkey‑Bloom module, a Rust implementation that adds Bloom Filter support to Valkey, contains a flaw that allows a specially crafted RESTORE command to trigger an assertion during RDB parsing. The assertion causes the server to shut down, delivering a denial‑of‑service. The issue occurs because the module failed to enable the VALKEYMODULE_OPTIONS_HANDLE_IO_ERRORS flag, which would normally allow the module to handle parsing errors gracefully. This bug existed before the commit a68614b6e3845777d383b3a513cedcc08b3b7ccd, which fixes the problem by setting the required flag.

All builds of Valkey‑Bloom produced by Valkey‑IO that include the legacy RESTORE handling code are affected. Users running the module within a Valkey server, on any platform that exposes the RESTORE command and has not applied the patch or disabled the command, are at risk. The vulnerable product is necessarily Valkey‑Bloom, a Rust‑based module for the Valkey distributed key‑value database.

The CVSS base score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a very low current likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, implying no publicly known supply‑chain attacks targeting it. An attacker who can send commands to the Valkey server can craft a malicious RESTORE payload that will cause the server to terminate, constituting a remote denial of service. The attack vector appears to be network‑based, though no public exploitation has been reported, making timely remediation prudent.