Denial of Service in Faktory Background Job Server

CVE-2026-63403

What is CVE-2026-63403?

The Faktory Background Job Server is susceptible to a denial of service due to improper handling of malformed commands. In versions before 1.10.0, an unauthenticated attacker can exploit this vulnerability by sending line-based commands without proper payloads, causing the server process to crash. This occurs as specific command handlers fail to verify the presence of necessary payload data, resulting in Go slice or index out-of-range panics. Without any recovery measures in place in the command-dispatch path, a single malformed command can lead to the termination of the entire server process, affecting all connected clients and active jobs. This flaw permits an attacker with only a basic connection to disrupt service continuously. The issue has been resolved in version 1.10.0.

References