Executive brief
Predis is a widely-used PHP client library for Redis caching and data stores. The library's pipeline feature, when used with clustered or replicated Redis deployments, fails to properly sanitize carriage-return/line-feed (CRLF) characters in command arguments. An attacker who can influence the data sent to Redis—such as through user-supplied URL slugs used as cache keys—can exploit this to inject arbitrary Redis commands. In production clusters, this allows wholesale deletion of cached data, targeted key theft, and server-wide outages; in replication setups, nearly every affected request can be crashed, causing a complete denial of service.
Technical details
The vulnerability is a CWE-93 improper CRLF neutralization flaw in AbstractAggregateConnection::write(). The method re-parses an already-serialized RESP (Redis Serialization Protocol) pipeline buffer using explode("\r\n") instead of respecting RESP length prefixes. This creates a second, client-side parser that treats attacker-controlled line breaks as command boundaries. An argument like "PAD\r\n*1\r\n$7\r\nFLUSHDB" is valid RESP data to the Redis server but appears as a complete FLUSHDB command to the flawed parser. On cluster connections, pipelined commands are routed per-chunk to different shards by slot; the injected command lands on a clean stream and executes (FLUSHDB wipes a shard, DEL/SET corrupt data, GET steals keys). On replication connections, all chunks go to the master, but the byte misalignment causes deserializeCommand() to throw an uncaught UnexpectedValueException, reliably crashing the request. Only pipeline() is affected; transaction()/MULTI paths are not. The fix (v3.3.0+) uses the real Command object, eliminating the second parser.
Affected products
- Predis Predis 3.0.0-RC1 to 3.2.0
Timeline
- 2026-08-21: disclosed: GitHub Advisory GHSA-w6f5-v2h6-g786 published
- 2026: patched: Fix in v3.3.0 via commit 053cb4b6 (PR #1586)