CVE-2026-63403: CWE-248: Uncaught Exception in contribsys faktory

Faktory, a language-agnostic background job server, has a vulnerability (CVE-2026-63403) in versions before 1.10.0 where certain command handlers do not validate the presence of payload data before slicing or indexing the input line. Commands such as PUSH, ACK, FAIL, BEAT, PUSHB, or QUEUE sent without payload cause a Go slice or index out-of-range panic. Because the server lacks recover() in the command dispatch path, this panic terminates the entire Go process, resulting in a denial of service that disconnects all clients and workers. The attack requires no authentication if no password is set and can be repeated indefinitely to keep the service down. The vulnerability is fixed in Faktory version 1.10.0.

An unauthenticated attacker can cause a denial of service by crashing the Faktory server process with a single malformed command. This results in immediate disconnection of all clients, workers, and in-flight jobs, disrupting background job processing until the server is restarted. The attack requires only network access to the command port and no credentials if no password is configured.

Upgrade Faktory to version 1.10.0 or later, where this issue is fixed. Until upgraded, restrict network access to the Faktory command port to trusted clients only and configure authentication passwords to prevent unauthenticated access. Patch status is not explicitly confirmed in the vendor advisory, but the fix is stated to be in version 1.10.0.