CVE-2026-63403

Name of the Vulnerable Software and Affected Versions Faktory versions prior to 1.10.0

Description An unauthenticated denial of service exists where a single malformed command can crash the entire process. The server uses a line-based wire protocol where several command handlers perform slicing or indexing on received lines at fixed offsets without verifying the presence of a payload. Sending a bare verb without a payload—such as PUSH, ACK, FAIL, BEAT, PUSHB, or QUEUE—triggers a Go slice or index out-of-range panic. Since the command-dispatch path lacks a recover() function, an unrecovered panic in a handler goroutine terminates the entire Go process, disconnecting all clients, workers, and in-flight jobs. The attack requires only a connection to the command port and the completion of the handshake, requiring no credentials if no password is configured.

Recommendations Update to version 1.10.0.