CVE-2026-84372

Received Received - Intake

Remote Code Execution in Predis PHP Client

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write() by splitting it with explode("\r\n") instead of honoring RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can therefore be interpreted by Command::deserializeCommand() as additional commands. On cluster connections, ClusterStrategy::getFakeKey() can route injected keyless commands using the literal fake key value "key", permitting operations such as shard-wide cache deletion, targeted data modification, data reads, or node disruption. On replication connections, malformed reparsing can throw an uncaught exception and repeatedly terminate affected requests. Only pipeline() reaches this vulnerable path; transaction() and MULTI are not affected. This issue is fixed in version 3.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84372

Affected Vendors & Products

Vendor	Product	Version / Range
predis	predis	to 3.3.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability affects Predis, a PHP client for Redis and Valkey. It allows attackers to inject commands by exploiting CRLF sequences in keys or values. The issue occurs when pipeline handling reparses a serialized buffer incorrectly, splitting it at CRLF instead of respecting RESP length prefixes. This can lead to unauthorized commands being executed on the Redis server.

Impact Analysis

An attacker could exploit this to perform unauthorized operations such as deleting cache, modifying data, reading sensitive information, or disrupting nodes. On cluster connections, commands can be routed to specific shards, while on replication connections, repeated crashes may occur due to uncaught exceptions.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, violating GDPR's data integrity and confidentiality requirements. For HIPAA, it may compromise protected health information (PHI) integrity and availability. Compliance failures could result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Predis to version 3.3.0 or later to address the pipeline handling vulnerability in cluster and replication connections.

Hi! I’m here to help you understand CVE-2026-84372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70