Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.

• cbl2 redis 6.2.18-3

Separate remediation guidance was not included in the collected bulletin.

1. Aug 7, 2026 at 12:21 AM UTC
   Published by Microsoft Security Response Center

   The publication date reported by the vendor.

2. Sep 27, 2026 at 11:11 PM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

3. Oct 15, 2026 at 5:20 AM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.