Do Son 
Security researchers recently uncovered a critical Predis command injection flaw, tracked as CVE-2026-84372. This vulnerability earned a maximum severity CVSS score of 9.8. Crucially, the technical details and proof-of-concept exploit code have been publicly disclosed.
- CVE: CVE-2026-84372
- CVSS: 9.8 (Critical · CVSSv3)
- Product: predis
- Affected: >= 3.0.0-RC1, < 3.3.0
- Impact: Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
- Status: No confirmed exploitation yet
- EPSS: 0.4% (30-day)
- Action: See vendor advisory
Why This Threat Matters
Predis operates as a highly popular Redis and Valkey client for PHP. Developers download this open-source package over 8.1 million times every single month. A successful Predis command injection flaw exploit allows unauthorized users to completely wipe entire cache clusters. Furthermore, malicious actors can steal specific encryption keys, poison cached session data, or trigger a repeatable denial of service state. Because the proof-of-concept is public, immediate defensive action is absolutely necessary to prevent widespread network compromise.
How the Attack Works
The vulnerability stems from an improper CRLF sequence neutralization flaw. Specifically, this bug affects the pipeline function handling on aggregate connections. The Predis client improperly re-parses an already serialized pipeline buffer. Instead of honoring the exact byte length prefixes, the software splits the data streams using carriage return line feed characters.
Consequently, an external attacker can embed these sequences inside a standard URL slug cache key. The client misinterprets these injected characters as a hard command boundary. The backend server then executes the smuggled Redis commands without validation. For example, an attacker can silently inject a flush command to erase a database shard.
Affected Versions
This Predis CRLF smuggling issue directly impacts versions 3.0.0-RC1 through 3.2.0. The vulnerable code path does not exist in older v1.x and v2.x branch releases. Remember, proof-of-concept exploit code is already publicly available, significantly increasing the risk of active exploitation.
Patch and Mitigation Steps
Administrators must update their affected PHP dependencies immediately to secure their infrastructure. The project maintainers permanently fixed this pipeline parsing issue in version 3.3.0. You should upgrade your environment to the newest branch, such as the Predis v3.6.0 release. If you require more technical context, review the official Predis security advisory. If you cannot apply the update immediately, you must avoid calling pipeline commands on cluster connections using attacker-influenced data.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
