CVE GHSA-w6f5-v2h6-g786 has a fix now, and if your PHP app talks to Redis through Predis, it’s worth upgrading before your next routine dependency pass.
What Was Actually Broken
The bug lives in AbstractAggregateConnection::write() and CommandInterface::deserializeCommand(), the code that serializes commands before they go out over the wire to a Redis cluster or sentinel setup. A crafted value passed through that path could smuggle CRLF sequences into the Redis protocol stream, injecting a second command that Redis would execute as separate from the one your application actually sent.
That’s not a theoretical bug. If user-controlled input reaches Predis’s connection layer, an attacker who can inject CRLF sequences can potentially read or write data outside the scope of the original command. In a clustered setup, the same bug class also opened the door to node misrouting: a command landing on a different node than the one it was meant for.
Predis 3.6.1 fixes the smuggling and misrouting issue at the source, and deprecates CommandInterface::deserializeCommand() as part of closing it. If your code calls that method directly, most Predis users won’t, plan to move off it.
Three Smaller Fixes Came Along for the Ride
The version number says 3.6.1, a patch release, but a patch with a CVE attached doesn’t belong in the same bucket as routine bug fixes. Three unrelated fixes shipped alongside it:
- RESP3 double parsing that incorrectly returned positive
INFfor-infpayloads - A
client_infoconnection parameter that was silently ignored - A dead-connection bug where
Stream::write()andread()left a broken connection behind after a host error handler threw
None of those three carry the urgency of the CVE. Prioritize the smuggling fix.
Why This One Hits Wide
Predis is the most widely used Redis client in PHP, and Laravel leans on Redis by default: cache, sessions, and queues all commonly run through it. If your Laravel app uses the redis cache driver, queues jobs through Redis, or stores sessions there, Predis is very likely the client doing that work.
composer update predis/predis gets most projects already on 3.x to the fix. If you’re pinned to an older major version, the fix isn’t backported past 3.6.1, so this is a good moment to evaluate the upgrade path.
How Scout Sees What Changes After You Upgrade
Scout Monitoring traces Redis calls made through Predis alongside your database queries, external HTTP calls, and background jobs. If a Redis call starts behaving differently after this upgrade, a connection timing change, a shift in throughput, Scout surfaces it in the same trace view you already use, so you’re not guessing whether the patch changed anything for your workload.
That matters most right after a security patch, when you want confidence the fix didn’t bring a regression with it.
For application monitoring with errors, logs, and traces, Scout Monitoring provides the fastest insights without the bloat.