CVE-2026-63403 in Faktory
Summary
by MITRE • 08/26/2026
Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malformed command crashes the entire process. Its wire protocol is line-based, and several command handlers slice or index the received line at a fixed offset, such as cmd[5:] for PUSH or qs[0] for QUEUE, without checking that a payload is present. Sending a bare verb with no payload, for example PUSH, ACK, FAIL, BEAT, PUSHB, or QUEUE, triggers a Go slice or index out-of-range panic. Because the codebase has no recover() anywhere in the command-dispatch path, an unrecovered panic in a handler goroutine terminates the whole Go process rather than just that connection, instantly disconnecting every other client, worker, and in-flight job. The attack requires only a connection to the command port and completion of the trivial handshake, with no credentials when no password is configured, and can be repeated to keep the service down indefinitely. This issue is fixed in version 1.10.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
Faktory serves as a language-agnostic background job server designed to handle asynchronous task processing across distributed systems. In versions prior to 1.10.0, this software contains a critical unauthenticated denial of service vulnerability that allows an attacker to crash the entire server process with minimal effort. The root cause lies in the implementation of its wire protocol, which is line-based and relies on specific command handlers to parse incoming requests. These handlers perform string slicing or indexing operations at fixed offsets without first verifying that the payload contains sufficient data length. For instance commands such as PUSH utilize a slice operation like cmd[5:], while QUEUE uses an index access like qs[0]. When a client sends only the verb portion of these commands, omitting any associated payload, the code attempts to access memory indices or slices that do not exist within the provided string buffer.
This lack of input validation triggers a Go runtime panic due to slice out-of-bounds indexing. In typical Go applications, such panics can often be recovered from using defer and recover statements to prevent application termination. However, in Faktory versions prior to 1.10.0, there are no recovery mechanisms implemented within the command-dispatch path. Consequently, an unrecovered panic in a handler goroutine causes the entire Go process to terminate immediately rather than merely closing the offending connection. This architectural flaw means that a single malformed request does not just disrupt one user or worker but brings down the whole service, instantly disconnecting all other connected clients and workers and halting any jobs currently in flight.
The operational impact of this vulnerability is severe, resulting in complete availability loss for the job processing infrastructure. An attacker requires only network connectivity to the command port and completion of a trivial handshake sequence to exploit this flaw. Notably, no authentication credentials are required if the server has not been configured with a password, making it accessible to any entity on the network that can reach the service port. The attack is easily repeatable; an adversary can continuously send malformed commands to keep the service down indefinitely, effectively creating a persistent denial of service condition without needing elevated privileges or complex exploit chains.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-755: Improper Handling of Exceptional Conditions. From a threat modeling perspective using MITRE ATT&CK, this behavior corresponds to T1499 Endpoint Denial of Service, specifically under the sub-category of Resource Exhaustion via Crash or Loop. The fix for this issue was released in version 1.10.0, where developers implemented proper input length checks before performing slice operations and added appropriate error handling to prevent panics from terminating the main process. Organizations running Faktory should immediately upgrade to version 1.10.0 or later to mitigate this risk. Until upgrading is possible, deploying network-level access controls such as firewalls or intrusion prevention systems to restrict connectivity to the Faktory command port can serve as a temporary compensating control against unauthenticated exploitation attempts.