SECURITY researchers have disclosed a critical vulnerability in the Predis PHP client for Redis, tracked as CVE-2026-84372. The flaw, rated CVSS 9.8 (Critical), has public PoC exploit code and is tied to a CRLF (carriage return line feed) sequence in the pipeline handling for aggregate connections. In short, the Predis client can misinterpret serialized pipeline data, allowing an attacker to smuggle and execute Redis commands through attacker-influenced inputs.
The disclosure notes that this could enable actions such as erasing entire cache clusters, stealing specific encryption keys, poisoning cached session data, or triggering a repeatable denial of service on affected systems.
The vulnerability directly affects Predis versions 3.0.0-RC1 up to 3.2.0; older v1.x and v2.x releases are not impacted. Because a PoC exploit is publicly available, the risk of active exploitation is considered high. Administrators are urged to apply the official patch promptly: the Predis maintainers fixed the pipeline parsing issue in version 3.3.0, with a recommended upgrade to newer releases such as Predis v3.6.0.
If immediate upgrading is not feasible, the advisory advises avoiding pipeline commands on cluster connections when data could be attacker-controlled. The article also directs readers to the official Predis security advisory GHSA-w6f5-v2h6-g786 for technical context and confirmation of mitigations. 9 September 2026.