Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by predis
CVE-2026-84372 (GCVE-0-2026-84372)
Vulnerability from nvd – Published: 2026-09-01 21:20 – Updated: 2026-09-02 19:33
VLAI
EPSS
VEX
Title
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
Summary
Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write() by splitting it with explode("\r\n") instead of honoring RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can therefore be interpreted by Command::deserializeCommand() as additional commands. On cluster connections, ClusterStrategy::getFakeKey() can route injected keyless commands using the literal fake key value "key", permitting operations such as shard-wide cache deletion, targeted data modification, data reads, or node disruption. On replication connections, malformed reparsing can throw an uncaught exception and repeatedly terminate affected requests. Only pipeline() reaches this vulnerable path; transaction() and MULTI are not affected. This issue is fixed in version 3.3.0.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 19:16 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/predis/predis/security/advisor… | x_refsource_CONFIRM |
| https://github.com/predis/predis/issues/1574 | x_refsource_MISC |
| https://github.com/predis/predis/pull/1586 | x_refsource_MISC |
| https://github.com/predis/predis/commit/053cb4b6a… | x_refsource_MISC |
| https://github.com/predis/predis/releases/tag/v3.3.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84372",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T19:16:03.863005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T19:33:06.330Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/predis/predis/issues/1574"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "predis",
"vendor": "predis",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0-RC1, \u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write() by splitting it with explode(\"\\r\\n\") instead of honoring RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can therefore be interpreted by Command::deserializeCommand() as additional commands. On cluster connections, ClusterStrategy::getFakeKey() can route injected keyless commands using the literal fake key value \"key\", permitting operations such as shard-wide cache deletion, targeted data modification, data reads, or node disruption. On replication connections, malformed reparsing can throw an uncaught exception and repeatedly terminate affected requests. Only pipeline() reaches this vulnerable path; transaction() and MULTI are not affected. This issue is fixed in version 3.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T21:20:57.138Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786"
},
{
"name": "https://github.com/predis/predis/issues/1574",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/predis/predis/issues/1574"
},
{
"name": "https://github.com/predis/predis/pull/1586",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/predis/predis/pull/1586"
},
{
"name": "https://github.com/predis/predis/commit/053cb4b6ac7fb1f469ead96a78d059bc0458e408",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/predis/predis/commit/053cb4b6ac7fb1f469ead96a78d059bc0458e408"
},
{
"name": "https://github.com/predis/predis/releases/tag/v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/predis/predis/releases/tag/v3.3.0"
}
],
"source": {
"advisory": "GHSA-w6f5-v2h6-g786",
"discovery": "UNKNOWN"
},
"title": "Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84372",
"datePublished": "2026-09-01T21:20:57.138Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-02T19:33:06.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84372 (GCVE-0-2026-84372)
Vulnerability from cvelistv5 – Published: 2026-09-01 21:20 – Updated: 2026-09-02 19:33
VLAI
EPSS
VEX
Title
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
Summary
Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write() by splitting it with explode("\r\n") instead of honoring RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can therefore be interpreted by Command::deserializeCommand() as additional commands. On cluster connections, ClusterStrategy::getFakeKey() can route injected keyless commands using the literal fake key value "key", permitting operations such as shard-wide cache deletion, targeted data modification, data reads, or node disruption. On replication connections, malformed reparsing can throw an uncaught exception and repeatedly terminate affected requests. Only pipeline() reaches this vulnerable path; transaction() and MULTI are not affected. This issue is fixed in version 3.3.0.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 19:16 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/predis/predis/security/advisor… | x_refsource_CONFIRM |
| https://github.com/predis/predis/issues/1574 | x_refsource_MISC |
| https://github.com/predis/predis/pull/1586 | x_refsource_MISC |
| https://github.com/predis/predis/commit/053cb4b6a… | x_refsource_MISC |
| https://github.com/predis/predis/releases/tag/v3.3.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84372",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T19:16:03.863005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T19:33:06.330Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/predis/predis/issues/1574"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "predis",
"vendor": "predis",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0-RC1, \u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write() by splitting it with explode(\"\\r\\n\") instead of honoring RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can therefore be interpreted by Command::deserializeCommand() as additional commands. On cluster connections, ClusterStrategy::getFakeKey() can route injected keyless commands using the literal fake key value \"key\", permitting operations such as shard-wide cache deletion, targeted data modification, data reads, or node disruption. On replication connections, malformed reparsing can throw an uncaught exception and repeatedly terminate affected requests. Only pipeline() reaches this vulnerable path; transaction() and MULTI are not affected. This issue is fixed in version 3.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T21:20:57.138Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786"
},
{
"name": "https://github.com/predis/predis/issues/1574",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/predis/predis/issues/1574"
},
{
"name": "https://github.com/predis/predis/pull/1586",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/predis/predis/pull/1586"
},
{
"name": "https://github.com/predis/predis/commit/053cb4b6ac7fb1f469ead96a78d059bc0458e408",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/predis/predis/commit/053cb4b6ac7fb1f469ead96a78d059bc0458e408"
},
{
"name": "https://github.com/predis/predis/releases/tag/v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/predis/predis/releases/tag/v3.3.0"
}
],
"source": {
"advisory": "GHSA-w6f5-v2h6-g786",
"discovery": "UNKNOWN"
},
"title": "Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84372",
"datePublished": "2026-09-01T21:20:57.138Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-02T19:33:06.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}