Predis Command Injection via CRLF Smuggling in Pipelined Commands (CVE-2026-84372)

A GitHub Security Advisory (GHSA-w6f5-v2h6-g786, CVE-2026-84372, CVSS 9.8) discloses an improper CRLF neutralization flaw (CWE-93) in predis/predis, the widely used PHP Redis client. According to the advisory, AbstractAggregateConnection::write() re-parses an already-serialized pipeline buffer by splitting on \r\n instead of honoring RESP length prefixes. An unauthenticated attacker who can influence any pipelined key or value — for example a URL slug used to build a cache key — can embed \r\n sequences that the Redis server treats as a single data value but that this client-side re-parser treats as a separate, valid Redis command.

Why It Matters

The advisory states this affects any application on predis/predis 3.0.0-RC1 through 3.2.0 that calls pipeline() over an aggregate connection (cluster or replication mode) with attacker-influenced data — a pattern common to cache lookups, sessions, and queued writes. Impact differs by connection type per the report:

• Cluster connections: described as remote command injection — smuggled commands can trigger shard-wide FLUSHDB, targeted DEL/SET, same-slot key theft via GET, cache poisoning, node memory exhaustion, and potential cluster outage via CLUSTER FLUSHSLOTS. The advisory notes Lua (EVAL) is not reachable due to incidental PHP class-naming and validation quirks, not a designed mitigation.
• Replication connections: described as a reliable, repeatable, unauthenticated denial-of-service — any pipelined value containing \r\n triggers an uncaught exception.

A PoC in the advisory demonstrates a two-shard cluster setup where a single crafted request drops the live key count from 100 to 62 via an injected FLUSHDB the application never issued; the advisory notes the injection succeeds with near-certainty on clusters with many shards.

What Defenders Should Do Now

• Inventory applications using predis/predis and check the version — versions 1.x, 2.x, and 3.0.0-alpha1 are reported as unaffected; the vulnerable range is 3.0.0-RC1–3.2.0.
• Upgrade to predis/predis 3.3.0 or later, which per the advisory fixes the issue by writing pipelined commands using the real Command object rather than the byte-splitting re-parser.
• If immediate upgrade isn't possible, the advisory recommends avoiding pipeline() on cluster or replication connections when keys or values include attacker-influenced input (e.g., URL-derived cache keys), since there is no reliable in-application way to neutralize embedded \r\n while the vulnerable parser remains in place.
• For hunting, consider monitoring Redis/cluster logs for unexpected FLUSHDB, CLUSTER FLUSHSLOTS, or anomalous DEL/SET activity that doesn't correlate with expected application commands, and watch for unexplained cache-hit-rate drops or dbsize anomalies following pipelined requests.

Developing Intel

This is a same-day GHSA publication with a public PoC and a CVSS 9.8 rating; details here reflect the advisory as published and may be updated as the community and Redis/Predis maintainers respond. See the original advisory for full technical detail and the confirmed fix commit: github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786.