Description

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write() by splitting it with explode("\r\n") instead of honoring RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can therefore be interpreted by Command::deserializeCommand() as additional commands. On cluster connections, ClusterStrategy::getFakeKey() can route injected keyless commands using the literal fake key value "key", permitting operations such as shard-wide cache deletion, targeted data modification, data reads, or node disruption. On replication connections, malformed reparsing can throw an uncaught exception and repeatedly terminate affected requests. Only pipeline() reaches this vulnerable path; transaction() and MULTI are not affected. This issue is fixed in version 3.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-01T22:17:18.987Z",
  "pubdate": "2026-09-01T22:17:18.987Z",
  "executiveSummary": "Predis versions 3.0.0-RC1 through 3.3.0 are vulnerable to command injection via improper RESP (REdis Serialization Protocol) buffer parsing in pipeline operations.\nThe vulnerability arises from the use of unsafe string splitting ('explode') on serialized buffers within the AbstractAggregateConnection::write() method, failing to respect RESP length prefixes.\nAttackers can supply malicious CRLF (Carriage Return Line Feed) sequences within keys or values, causing the parser to misinterpret data as injected Redis commands.\nSuccessful exploitation allows for arbitrary command execution, including shard-wide cache deletion, unauthorized data modification, sensitive data exfiltration, and service disruption via node termination.\nThis issue specifically impacts pipeline() functionality on aggregate cluster and replication connections, while transaction() and MULTI operations remain unaffected.\nThe vulnerability represents a critical risk to data integrity and service availability, requiring immediate software updates to mitigate unauthorized command execution.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of the RESP protocol within the AbstractAggregateConnection::write() function. Instead of parsing the serialized buffer according to the protocol's length prefixes—which define the boundaries and structure of commands—the implementation employs an insecure explode('\\r\\n', $buffer) operation.\nBy splitting the buffer on CRLF sequences, the parser becomes susceptible to command injection if an attacker-controlled key or value contains these characters. When Command::deserializeCommand() processes these strings, it erroneously treats the injected CRLF sequences as command delimiters, effectively breaking out of the intended command structure.\nIn cluster-based environments, the vulnerability is compounded by the behavior of ClusterStrategy::getFakeKey(). The parser can route these injected, keyless commands using the literal string 'key'. This mechanism allows an attacker to manipulate command routing, facilitating unauthorized operations across the entire shard or targeted node.\nFor replication-based connections, the flawed reparsing logic creates a denial-of-service vector. When the malformed buffer is processed, the system may trigger an uncaught exception during deserialization. Repeatedly triggering this exception results in the termination of the affected request, leading to service instability.\nThe attack flow proceeds as follows: 1) The attacker identifies a target pipeline operation where user-supplied input is passed to a Redis command. 2) The attacker crafts a payload containing CRLF sequences followed by arbitrary Redis commands (e.g., 'FLUSHDB' or 'GET' sensitive keys). 3) The Predis client serializes the data for the pipeline. 4) The AbstractAggregateConnection::write() method encounters the CRLF sequences and splits the buffer prematurely. 5) The downstream logic treats the second half of the split string as a legitimate command, executing it against the Redis or Valkey server.\nThis vulnerability is restricted to the pipeline() implementation in Predis. Authenticated access is typically assumed as a prerequisite for interacting with the client; however, the impact is significant, moving from simple data manipulation to full node disruption."
}