CVE-2026-84372: Predis PHP Client RCE Vulnerability

CVE-2026-84372 Overview

CVE-2026-84372 is a CRLF injection vulnerability in Predis, a widely used Redis and Valkey client library for PHP. The flaw affects versions 3.0.0-RC1 through 3.2.x and stems from unsafe reparsing of already serialized RESP (REdis Serialization Protocol) buffers during pipeline operations on aggregate cluster and replication connections. Attacker-controlled keys or values containing \r\n sequences are interpreted as additional Redis commands, enabling command injection into the pipeline. The issue is fixed in Predis version 3.3.0 and is tracked as [CWE-93] (Improper Neutralization of CRLF Sequences).

Critical Impact
Attackers can inject arbitrary Redis commands through pipeline inputs, enabling shard-wide cache deletion, data modification, unauthorized reads, and denial of service on replication connections.

Affected Products

Predis PHP client versions 3.0.0-RC1 through 3.2.x
Applications using pipeline() on aggregate cluster connections
Applications using pipeline() on replication connections

Discovery Timeline

2026-09-01 - CVE-2026-84372 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84372

Vulnerability Analysis

The vulnerability lives in AbstractAggregateConnection::write(), which handles pipeline dispatch for aggregate cluster and replication connections. Instead of honoring RESP length prefixes when routing serialized commands, the method splits an already serialized RESP buffer using explode("\r\n"). Any CRLF characters embedded in attacker-controlled keys or values are treated as protocol delimiters rather than opaque payload bytes.

As a result, Command::deserializeCommand() reinterprets the split buffer and constructs additional Redis commands from data that should have remained inside a single command payload. On cluster deployments, ClusterStrategy::getFakeKey() routes any injected keyless commands using the literal fake key value "key", giving the attacker a deterministic path to a specific shard. Only the pipeline() code path is affected; transaction() and MULTI do not reach the vulnerable reparser.

Root Cause

The root cause is a violation of RESP framing semantics. RESP uses explicit length prefixes for bulk strings so that binary-safe payloads, including those containing CRLF bytes, can transit safely. By reparsing a serialized buffer with a text-oriented explode("\r\n") split, Predis discards those length guarantees. This turns any application that passes user-controlled strings into Redis pipeline arguments into a command injection sink.

Attack Vector

An attacker who can influence a single key or value passed to pipeline() supplies a payload containing \r\n followed by a crafted RESP command. On cluster connections, injected commands can perform shard-wide FLUSHDB, targeted SET/DEL, arbitrary reads, or node disruption. On replication connections, malformed reparsing throws an uncaught exception, repeatedly terminating affected requests and yielding denial of service.

php

// Security patch in src/Pipeline/ConnectionErrorProof.php
// Refactor: pipeline data writing now depends on connection type (#1586)
        $responses = [];
        $sizeOfPipe = count($commands);
        $exceptions = [];
-        $buffer = '';

        foreach ($commands as $command) {
-            $buffer .= $command->serializeCommand();
+            $nodeConnection = $connection->getConnectionByCommand($command);
+            $nodeConnection->write($command->serializeCommand());
        }

-        $connection->write($buffer);
-
        for ($i = 0; $i < $sizeOfPipe; ++$i) {
            $command = $commands->dequeue();
// Source: https://github.com/predis/predis/commit/053cb4b6ac7fb1f469ead96a78d059bc0458e408

The fix removes buffer concatenation and reparsing. Each command is now serialized and written to its own resolved node connection, eliminating the explode("\r\n") reinterpretation path.

Detection Methods for CVE-2026-84372

Indicators of Compromise

Redis command logs containing unexpected FLUSHDB, FLUSHALL, DEL, or CONFIG operations originating from application service accounts that normally only issue GET/SET.
PHP application logs showing Predis\Response\ServerException or uncaught RESP parsing exceptions on replication connections.
HTTP request bodies or query parameters containing raw \r\n sequences forwarded to cache keys or values.
Cluster MONITOR output showing commands routed to the literal key "key" from user-driven code paths.

Detection Strategies

Perform a software composition analysis (SCA) scan of composer.lock files to identify predis/predis versions below 3.3.0.
Add web application firewall (WAF) rules that block or flag inbound parameters containing CRLF byte sequences destined for cache-backed endpoints.
Enable Redis MONITOR or slowlog auditing in staging to identify unexpected command types issued through pipelines.

Monitoring Recommendations

Alert on sudden bursts of destructive commands (DEL, FLUSHDB, FLUSHALL) against production Redis or Valkey clusters.
Track error rates for replication-backed workloads; repeated uncaught RESP exceptions indicate active exploitation attempts.
Baseline the set of Redis command verbs each service normally issues and alert on deviations.

How to Mitigate CVE-2026-84372

Immediate Actions Required

Upgrade predis/predis to version 3.3.0 or later across all PHP applications using cluster or replication topologies.
Audit application code for pipeline() usage that incorporates user-controlled keys or values and add strict input validation.
Rotate any sensitive cached data that may have been read or modified if exploitation is suspected.

Patch Information

The fix is delivered in Predis v3.3.0 via pull request #1586 and commit 053cb4b. Details are documented in GHSA-w6f5-v2h6-g786 and the original issue #1574.

Workarounds

Reject or strip CRLF (\r\n) byte sequences from any user-supplied string before it becomes a Redis key or value.
Replace pipeline() calls with transaction() or MULTI where feasible; those paths do not reach the vulnerable reparser.
Restrict Redis command surface using ACLs so application accounts cannot issue destructive commands such as FLUSHDB or CONFIG.

bash

# Update Predis to the patched release
composer require predis/predis:^3.3.0

# Verify installed version
composer show predis/predis | grep versions

# Optional: enforce a Redis ACL that limits destructive commands
redis-cli ACL SETUSER app_service on >STRONG_PASSWORD \
    ~* +@read +@write -@dangerous -flushdb -flushall -config