Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-84372: Predis PHP client may run injected commands and crash
CVE-2026-84372 · published 2 days ago
Summary
The PHP library Predis, used to talk to Redis databases, mishandles batched commands in certain versions. An attacker who can supply specially crafted data could make the client execute unintended commands or cause it to stop working. Upgrade Predis to the latest version to stop this from happening.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| predis | predis | >= 3.0.0-RC1, < 3.3.0 |
Original advisory text
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write() by splitting it with explode("\r\n") instead of honoring RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can therefore be interpreted by Command::deserializeCommand() as additional commands. On cluster connections, ClusterStrategy::getFakeKey() can route injected keyless commands using the literal fake key value "key", permitting operations such as shard-wide cache deletion, targeted data modification, data reads, or node disruption. On replication connections, malformed reparsing can throw an uncaught exception and repeatedly terminate affected requests. Only pipeline() reaches this vulnerable path; transaction() and MULTI are not affected. This issue is fixed in version 3.3.0.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84372... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84372 Vendor Advisory
- https://github.com/predis/predis/commit/053cb4b6ac7fb1f469ead96a78d059bc0458e408 Patch
- https://github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786 Vendor Advisory
- https://github.com/predis/predis/issues/1574 Third Party Advisory
- https://github.com/predis/predis/pull/1586 Patch
- https://github.com/predis/predis/releases/tag/v3.3.0 URL
Severity
9.8
Critical
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS <1%
Type
CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
Timeline
Published1 Sep 2026
Updated3 Sep 2026
First seen2 Sep 2026
Monitor software like this
Free during beta