Pipeline Handling Vulnerability in Predis Redis Client by Predis Team

CVE-2026-84372

What is CVE-2026-84372?

Predis, a versatile Redis client for PHP, has a flaw in its pipeline handling from versions 3.0.0-RC1 to 3.3.0. This vulnerability arises when aggregate cluster and replication connections improperly reparse serialized RESP buffers. By utilizing the explode() function incorrectly, attacker-controlled keys or values may introduce CRLF sequences. Consequently, these can be misinterpreted as additional commands during deserialization, leading to unauthorized command executions such as shard-wide cache deletions, targeted data modifications, or disruption of node operations. Furthermore, on replication connections, malformed requests can lead to uncaught exceptions that disrupt normal operations. This issue has been addressed and resolved in version 3.3.0.

References