A CRLF injection vulnerability exists in the Predis PHP Redis/Valkey client library affecting versions 3.0.0-RC1 through 3.3.0. The flaw resides in pipeline handling on aggregate cluster and replication connections, where AbstractAggregateConnection::write() incorrectly reparses serialized RESP buffers using explode('\r\n') instead of respecting RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can be interpreted as additional commands via Command::deserializeCommand(). On cluster connections, injected keyless commands can be routed using a literal fake key, enabling shard-wide cache deletion, data modification, data reads, or node disruption. On replication connections, the vulnerability can cause uncaught exceptions that repeatedly terminate requests, resulting in denial of service. Only the pipeline() method is affected; transaction() and MULTI are not vulnerable. The vulnerability has been patched in version 3.3.0 of Predis.
