CVE-2026-84372

Name of the Vulnerable Software and Affected Versions Predis versions 3.0.0-RC1 through 3.2.9

Description Pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP (Redis Serialization Protocol) buffer in the write() function of AbstractAggregateConnection by splitting it with explode("r ") instead of honoring RESP length prefixes. This allows attacker-controlled keys or values containing CRLF (Carriage Return Line Feed) sequences to be interpreted by the deserializeCommand() function as additional commands. On cluster connections, the getFakeKey() function in ClusterStrategy can route these injected keyless commands using the literal fake key value "key", enabling shard-wide cache deletion, targeted data modification, data reads, or node disruption. On replication connections, this malformed reparsing can trigger an uncaught exception, causing affected requests to terminate repeatedly. This issue only affects the pipeline() function; transaction() and MULTI are not impacted.

Recommendations Update to version 3.3.0. As a temporary workaround, avoid using the pipeline() function until the update is applied.