CVE-2026-84372: Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
An improper CRLF neutralization flaw in Predis’ pipeline handling on aggregate connections lets an unauthenticated attacker who can influence any pipelined argument — a value or a key, e.g. a URL slug used as a cache key — smuggle arbitrary Redis commands into the connection.
- On cluster connections (
clusteroption, incl. client-side sharding) this is remote command injection: shard-wideFLUSHDB, targetedDEL/SET, same-slot key theft viaGET, cache poisoning, and possible node/cluster outage. - On replication connections (
replicationoption) it is a reliable, repeatable denial of service (uncaught fatal error) triggered by any value containing\r\n.
References
- github.com/advisories/GHSA-w6f5-v2h6-g786
- github.com/predis/predis/commit/053cb4b6ac7fb1f469ead96a78d059bc0458e408
- github.com/predis/predis/issues/1574
- github.com/predis/predis/pull/1586
- github.com/predis/predis/releases/tag/v3.3.0
- github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786
- nvd.nist.gov/vuln/detail/CVE-2026-84372
Code Behaviors & Features
Detect and mitigate CVE-2026-84372 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →