External risk intelligence

Predis PHP Client CRLF Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-84372

Predis is a client-side PHP library used by applications to communicate with Redis/Valkey servers. It is not an internet-facing service or appliance itself. While it processes data that might originate from users, the library is an internal application component, making direct public-internet exposure of this specific code path uncommon.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Predis PHP client for Redis and Valkey, specifically impacting how it handles certain data formats when processing pipelined commands on cluster or replication connections. The flaw could allow an attacker to inject commands, potentially leading to broad cache deletion, data modification, data retrieval, or disruption of services.

Data corruption and service disruption risk.
Affects how applications manage data remotely.
Confirm relevance and identify affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could inject specially crafted commands into a Redis pipeline that is processed by the Predis PHP client. This occurs when the client incorrectly parses serialized data, allowing attacker-controlled input to be interpreted as new commands. On cluster connections, this can lead to widespread data modification or disruption, while on replication connections, it might cause application instability.

No authentication required to trigger.
Malformed pipeline data is the trigger.
Uncontrolled data modification and node disruption.

Live Threat

Current exploitation, exposure, and threat context

When Redis pipeline handling on aggregate cluster and replication connections is improperly managed, attacker-controlled data containing specific character sequences could be interpreted as additional commands. This may allow for unauthorized operations on the Redis server, including data modification, deletion, or disruption, particularly when used with cluster connections.

Redis cluster data integrity.
Malicious data in pipeline commands.
Unintended data loss or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The primary responsibility for addressing this vulnerability lies with application teams using the Predis library, as it is a client-side PHP component. Infrastructure or platform teams may need to coordinate with application owners to identify affected deployments. The first practical step is to inventory all applications utilizing Predis, confirm the specific versions in use, and assess exposure based on whether these applications are internet-facing or handle untrusted input.

Application owners must manage the issue.
Verify all Predis client versions.
Plan maintenance for affected applications.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Predis and how is it used?

Predis is a popular PHP library that acts as a bridge between your application code and Redis or Valkey databases. Developers use it to send commands and manage data stored in these high-performance memory structures. Because it resides within your application architecture, it handles the serialization and communication flow required to talk to remote cache clusters and database replicas.

What does CWE-93 mean for CVE-2026-84372?

CWE-93 refers to Improper Neutralization of CRLF Sequences. In the context of this CVE, it means the library incorrectly splits data using carriage return and line feed characters instead of respecting the formal length definitions of the protocol. This oversight allows characters intended as plain data values to be misinterpreted by the system as new, separate commands, effectively breaking the intended structure of the communication.

How do attackers trigger this vulnerability?

An attacker must supply specially crafted input that is subsequently processed by a Predis pipeline connection. This trigger relies on the input containing specific CRLF sequences that cause the library to re-parse the buffer incorrectly. Note that this flaw is isolated to the pipeline() function; standard transaction() calls and MULTI commands are explicitly designed differently and are not impacted by this specific parsing error.

Is my application at risk?

According to Halo Surface Signal, this library is an internal component, making direct public-internet exposure of this code path unlikely. Your primary concern is whether your application processes untrusted user input that eventually passes through a Predis pipeline. If your application logic allows external data to reach these specific database connection paths, the risk of unauthorized command execution or data disruption increases.

How do I address this Predis vulnerability?

The fix requires updating the Predis library to version 3.3.0 or later, which corrects the serialization parsing logic. Begin by auditing your application inventory to locate where Predis is utilized and identify which versions are currently deployed. Coordinate with your application development teams to prioritize these updates, focusing specifically on services that handle complex data pipelines or interact with cluster and replication configurations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.