VulnSocial

CVE-2026-84372PoC

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (5 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write() by splitting it with explode("\r\n") instead of honoring RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can therefore be interpreted by Command::deserializeCommand() as additional commands. On cluster connections, ClusterStrategy::getFakeKey() can route injected keyless commands using the literal fake key value "key", permitting operations such as shard-wide cache deletion, targeted data modification, data reads, or node disruption. On replication connections, malformed reparsing can throw an uncaught exception and repeatedly terminate affected requests. Only pipeline() reaches this vulnerable path; transaction() and MULTI are not affected. This issue is fixed in version 3.3.0.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-93

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 6 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 4 signals
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 6 signals
  • Disclosure: 2 classified signals
  • Peaked at 5 mentions on most recent observed day (2026-09-09)
  • 6 total mentions across 2 days

Deep dive

Activity timeline6 mentions / 2d
01345Mentions · 2026-09-07: 1Mentions · 2026-09-09: 5PoC Mentioned / Linked · 2026-09-09: 4Exploit Tool / Code · 2026-09-09: 1Patch / Workaround · 2026-09-09: 3Technical Details · 2026-09-07: 1Technical Details · 2026-09-09: 509-0709-09
Signal classification2 categories
PoC
466.7%
Disclosure
233.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-071
Disclosure1
2026-09-095
Disclosure1PoC4
Full discourse6 posts
  • yousukezan@yousukezan
    PoC

    Predisに最大深刻度のRedisコマンドインジェクション脆弱性「CVE-2026-84372」が見つかった。公開済みPoCを使うと、外部からRedisコマンドを挿入し、キャッシュ削除や情報取得、DoSを引き起こせる。 原因はaggregate connection上のpipeline処理で、すでにシリアライズされたバッファをCRLFで再分割してしまう実装不備にある。攻撃者がcache keyへCRLFを埋め込むと、Predisがそれをコマンド境界として誤認し、Redis側で追加コマンドが実行される。 影響するのはPredis 3.0.0-RC1以上3.3.0未満で、v1.xとv2.xは影響を受けない。修正版は3.3.0で、記事は最新の3.6.0などへの更新を推奨している。すぐ更新できない場合は、攻撃者が影響できるデータを使ってcluster connection上でpipelineを呼び出さないよう求めている。 PredisはPHP向けRedis／Valkeyクライアントで、月間810万回超ダウンロードされる。現時点で実悪用は確認されていないが、技術詳細とPoCは公開済みである。 https://securityonline.info/cve-2026-84372-predis-command-injection-flaw/

    Post summary

    CVE‑2026‑84372 is a command‑injection flaw in Predis; a PoC exists, patching is advised, but no active exploitation has been reported.

    000321.4K
    16.5K followersView on X
  • kokumօtօ@__kokumoto
    PoC

    PHPのRedisクライアントPredisに重大(Critical)な脆弱性。CVE-2026-84372はCVSSスコア9.8で、CRLFスマグリングによるコマンドインジェクション。PoC（攻撃の概念実証コード）あり。3.0.0-RC1から3.2.0に影響し、1.x系統と2.x系統には影響しない。バージョン3.3.0で修正。 https://securityonline.info/cve-2026-84372-predis-command-injection-flaw/

    Post summary

    Critical command‑injection vulnerability in Predis (CVE‑2026‑84372) with a PoC, CVSS 9.8, affected between versions 3.0.0‑RC1 and 3.2.0, and fixed in version 3.3.0.

    00002628
    7.8K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    PoC

    Details and PoC for CVE-2026-84372 are publicly disclosed. This Predis command injection flaw via CRLF smuggling allows complete cluster compromise. #Predis #CommandInjection #CVE202684372 #Cybersecurity #Vulnerability https://securityonline.info/cve-2026-84372-predis-command-injection-flaw/

    Post summary

    The post communicates publicly available details and a PoC for a Predis command injection vulnerability that could fully compromise an entire cluster via CRLF smuggling.

    00010436
    12.9K followersView on X
  • moton@moton
    PoC

    CVE-2026-84372 PoC Disclosed: Predis Command Injection Flaw - https://securityonline.info/cve-2026-84372-predis-command-injection-flaw/

    Post summary

    A Proof of Concept for a Predis command injection flaw (CVE-2026-84372) has been disclosed with an accompanying link to detailed information.

    0000071
    756 followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨Critical - Predis pipeline CRLF RESP Re-parse Command Injection (CVE-2026-84372) predis/predis pipeline() on aggregate cluster/replication connections re-parses an already-serialized RESP buffer via CRLF splitting instead of RESP length prefixes. Attacker-controlled keys/values with CRLF can smuggle extra Redis commands on cluster, and trigger uncaught exceptions for repeatable DoS on replication. Non-pipelined commands aren’t affected. 👉Affected: predis/predis < 3.3.0 | Upgrade to 3.3.0

    Post summary

    CVE‑2026‑84372 exposes a critical command injection and DoS flaw in Predis pipeline handling, affecting versions <3.3.0; users should upgrade to 3.3.0 to remediate.

    0000063
    304 followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen CVE-2026-84372 in Predis: Kritische Command-Injection über CRLF in PHP-Redis-Clients #cve202684372 #php #predis #redis #valkey https://cybersecurity-news.de/cve-2026-84372-predis-command-injection-crlf

    Post summary

    The tweet announces a critical CRLF-based command injection vulnerability in Predis, with no exploit or patch information provided.

    0000040
    12 followersView on X

Explore more

Back to dashboard