Predis Redis Library Flaw: CRLF Smuggling Risk
- Severity
- HIGH
- Affected component
- predis (packagist)
- Affected versions
- >= 3.0.0-RC1, < 3.3.0
- Patched version
- Not yet available
An improper CRLF neutralization flaw in Predis Redis library versions 3.0.0-RC1 to 3.3.0 may allow unauthenticated attackers to inject arbitrary Redis commands or cause denial of service.
What happened
An early warning has been issued regarding a critical vulnerability in the Predis Redis library. The flaw, tracked as CVE-2026-84372 and GHSA-W6F5-V2H6-G786, involves improper CRLF neutralization in pipeline handling on aggregate connections. This vulnerability could enable an unauthenticated attacker to smuggle arbitrary Redis commands into the connection, potentially leading to remote command injection or denial of service. The affected versions range from 3.0.0-RC1 to 3.3.0. Engineers using Predis in this version range should assess their exposure by reviewing their Redis command handling and pipeline configurations.
The vulnerability was first flagged on September 8, 2026. It is currently under investigation and has not been reported as exploited in the wild. However, the potential impact is significant, warranting immediate attention from those using affected versions of Predis.
What to do about it
- Upgrade to the latest version of Predis that patches this vulnerability.
- Review your Redis command handling and pipeline configurations for any signs of unexpected behavior.
- Monitor the primary sources for updates on this vulnerability.
- Consider implementing additional security measures to detect and prevent unauthorized Redis command execution.
How 0Day would have caught this
predis is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using Predis versions 3.0.0-RC1 to 3.3.0.
What should I do right now?
Immediately upgrade to the latest version of Predis that patches this vulnerability and review your Redis configurations.
Has this been exploited in the wild?
There are no reports of this vulnerability being exploited in the wild at this time.
Where can I find more information?
Consult the primary sources provided in the incident data for the most up-to-date information.