CVE-2026-84372

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write() by splitting it with explode("\r\n") instead of honoring RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can therefore be interpreted by Command::deserializeCommand() as additional commands. On cluster connections, ClusterStrategy::getFakeKey() can route injected keyless commands using the literal fake key value "key", permitting operations such as shard-wide cache deletion, targeted data modification, data reads, or node disruption. On replication connections, malformed reparsing can throw an uncaught exception and repeatedly terminate affected requests. Only pipeline() reaches this vulnerable path; transaction() and MULTI are not affected. This issue is fixed in version 3.3.0.

• CWE-93

• https://github.com/predis/predis/commit/053cb4b6ac7fb1f469ead96a78d059bc0458e408
• https://github.com/predis/predis/issues/1574
• https://github.com/predis/predis/pull/1586
• https://github.com/predis/predis/releases/tag/v3.3.0
• https://github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786
• https://github.com/predis/predis/issues/1574
• https://github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786

Published

Sep 1, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84366Scrapy is a high-level web crawling and scraping framework f…7.4
• CVE-2026-84367joi is a schema description language and data validator for …3.7
• CVE-2026-84368joi is a schema description language and data validator for …3.7
• CVE-2026-84369SVGO, short for SVG Optimizer, is a Node.js library and comm…6.1
• CVE-2026-84370SVGO, short for SVG Optimizer, is a Node.js library and comm…8.2
• CVE-2026-84371ApostropheCMS is an open-source Node.js content management s…5.4
• CVE-2026-84373Vitest is a testing framework powered by Vite. From 2.1.0 un…5.9
• CVE-2026-84374Laravel Excel provides supercharged Excel exports and import…7.5
• CVE-2026-84375js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 u…7.5
• CVE-2026-84376Astro is a web framework for content-driven websites. Prior …6.3
• CVE-2026-84377LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…6.5
• CVE-2026-84378HTTPX2 is a next generation HTTP client for Python. From 2.5…5.9