CVE-2026-84372

Predis, a widely used PHP Redis client library, improperly neutralizes CRLF sequences (CWE-93) when executing pipelines over aggregate connections: its write path re-parses the already-serialized RESP buffer by splitting on CRLF instead of honoring length prefixes, so attacker-controlled CRLF inside a pipelined argument or key is treated as a command boundary. An unauthenticated attacker who can influence any pipelined value or key (for example, a URL slug used as a cache key) can smuggle arbitrary Redis commands into the connection. On cluster connections this is full command injection, enabling shard-wide FLUSHDB wipes, targeted DEL/SET manipulation, same-slot key theft via GET, cache poisoning, INFO configuration leaks, and possible node or cluster outage via CLUSTER FLUSHSLOTS; on replication connections any value containing CRLF triggers an uncaught exception, yielding a reliable, repeatable denial of service. PHP applications that run pipelines over Predis cluster or replication connections with attacker-controllable arguments are affected. No public proof-of-concept, KEV listing, or known exploitation exists; EPSS currently estimates a 0.4% probability of exploitation within 30 days.

What to do: Upgrade Predis to a patched release as soon as one is available (the vulnerable code is referenced in v3.2.0; no fixed version is named in the available data). As interim mitigations, avoid executing pipelines over cluster or replication connections, or strip/filter carriage-return and line-feed characters from attacker-controlled pipelined arguments and cache keys. Check whether your Redis servers show unexpected commands (e.g., FLUSHDB, CLUSTER FLUSHSLOTS, INFO) and whether application error logs show uncaught 'Invalid serializing format' exceptions from Predis, which would indicate the replication-mode DoS path.