CVE-2026-63403: Faktory DOS Vulnerability

CVE-2026-63403 Overview

Faktory, a language-agnostic background job server maintained by Contribsys, contains an unauthenticated denial-of-service vulnerability in versions prior to 1.10.0. A single malformed command sent to the command port crashes the entire server process. The wire protocol is line-based, and several command handlers slice or index the received line at a fixed offset without validating that a payload is present. Because the codebase lacks any recover() in the command-dispatch path, an unrecovered Go panic in a handler goroutine terminates the whole process rather than the offending connection. The issue is tracked under [CWE-248] (Uncaught Exception) and is fixed in version 1.10.0.

Critical Impact
An unauthenticated attacker with network access to the Faktory command port can crash the server with a single malformed verb, disconnecting all clients, workers, and in-flight jobs, and can repeat the attack to keep the service down indefinitely.

Affected Products

Contribsys Faktory versions prior to 1.10.0
Deployments where no password is configured on the command port
Any client, worker, or in-flight job dependent on the Faktory process

Discovery Timeline

2026-08-25 - CVE-2026-63403 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-63403

Vulnerability Analysis

Faktory's wire protocol is line-based. Each inbound line is parsed by a verb-dispatch loop that hands the raw command bytes to a handler function. Several handlers assume a payload follows the verb and index the buffer at a fixed offset without a length check. For example, the PUSH handler reads cmd[5:] to extract the JSON job, and the QUEUE handler reads qs[0] to access the first queue name. When a client sends a bare verb such as PUSH, ACK, FAIL, BEAT, PUSHB, or QUEUE with no payload, the slice or index operation triggers a Go out-of-range panic.

The dispatch loop invokes handler goroutines directly without any recover(). An unrecovered panic in a goroutine terminates the entire Go runtime rather than the single connection that caused it. The result is a full process crash that instantly severs every other connected client, worker, and job.

Root Cause

The root cause is a missing input-length check in multiple command handlers combined with the absence of panic recovery in the dispatch path. The handlers trust that every recognized verb arrives with a payload of the expected shape, so slicing operations such as cmd[5:] execute without bounds validation. The panic then propagates upward with no defer recover() to contain it.

Attack Vector

Exploitation requires only TCP reachability to the Faktory command port and completion of the trivial handshake. When no password is configured, no credentials are needed. An attacker sends a single line containing a bare verb followed by a newline, and the server terminates. Reconnecting and repeating the request keeps the service offline indefinitely.

// Patch excerpt from server/server.go
            atomic.AddUint64(&s.Stats.Commands, 1)
            ctx, cancel := context.WithTimeout(context.Background(), time.Duration(5*time.Second))
            conn.Context = ctx
-           proc(conn, s, cmd)
+           safeDispatch(proc, conn, s, cmd)
            cancel()
        }
        if verb == "END" {
// Source: https://github.com/contribsys/faktory/commit/c2f17e390fc7d38b6ece82b8da23f5ca15646212

The fix wraps handler invocation in safeDispatch, which installs a recover() so a panicking handler only tears down the offending connection rather than the whole process.

Detection Methods for CVE-2026-63403

Indicators of Compromise

Unexpected termination of the Faktory process without a preceding shutdown signal in service manager or container orchestration logs.
Simultaneous disconnects across all Faktory clients and workers, followed by repeated reconnect attempts.
Inbound TCP sessions to the Faktory command port (default 7419) that send a bare verb such as PUSH\n, ACK\n, FAIL\n, BEAT\n, PUSHB\n, or QUEUE\n and immediately close.

Detection Strategies

Alert on Faktory process exits with non-zero status or Go runtime panic messages such as runtime error: slice bounds out of range in stdout or stderr.
Inspect network traffic to the command port for short-lived sessions containing single-verb payloads with no arguments.
Correlate mass worker disconnect events with the timestamp of the last accepted command to identify the trigger.

Monitoring Recommendations

Track Faktory uptime, restart frequency, and worker connection counts as first-class service health metrics.
Forward Faktory stdout and stderr, including panic stack traces, to a centralized log platform for retention and search.
Enable connection-level logging on the Faktory command port and monitor for anomalous single-line requests from untrusted sources.

How to Mitigate CVE-2026-63403

Immediate Actions Required

Upgrade Faktory to version 1.10.0 or later, which introduces safeDispatch and contains the panic in the offending connection.
Restrict network exposure of the Faktory command port to trusted application and worker subnets only.
Configure a password on the Faktory command port so unauthenticated clients cannot complete the handshake.

Patch Information

The fix is available in Faktory 1.10.0. See the GitHub Security Advisory GHSA-gc57-f6pg-m9h6 and the corresponding server.go commit that wraps handler invocation in safeDispatch with a recover().

Workarounds

Place Faktory behind a firewall or security group that only allows connections from known application hosts.
Require a password on the command port to raise the bar for anonymous attackers on shared networks.
Run Faktory under a process supervisor such as systemd or Kubernetes with automatic restart to shorten outage windows until patching is complete.

bash

# Restrict Faktory command port (default 7419) to trusted workers only
sudo iptables -A INPUT -p tcp --dport 7419 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 7419 -j DROP

# Require a password on the command port
export FAKTORY_PASSWORD="$(openssl rand -base64 32)"
./faktory -b 0.0.0.0:7419