GHSA-W6F5-V2H6-G786 Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Summary An improper CRLF neutralization flaw in Predis' pipeline handling on aggregate connections lets an unauthenticated attacker who can influence any pipelined argument — a value or a key, e.g. a URL slug used as a cache key — smuggle arbitrary Redis commands into the connection. - On cluster...

CVE-2026-84372

Predis , a PHP client for Redis and Valkey, is affected by a critical (CVSS 9.8) Redis command injection and denial of service vulnerability in versions 3.0.0-RC1 through 3.3.0 . The root cause lies in AbstractAggregateConnection::write(), which reparses an already serialized RESP buffer using ex...

CVE-2026-84372 Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...

CVE-2026-47240

Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing...

nginx -- inject commands into SSL session vulnerability

The nginx project reports: Security: pipelined commands were not discarded after STARTTLS command in SMTP proxy CVE-2014-3556; the bug had appeared in 1.5.6...