Executive brief
Faktory is a background job processing server that distributes work across multiple workers. A flaw in the wire protocol allows any unauthenticated attacker to crash the entire server with a single malformed command, instantly disconnecting all workers and stopping all in-flight jobs. The service can be repeatedly crashed, keeping it offline indefinitely.
Technical details
The vulnerability is an uncaught exception (CWE-248) in Faktory's line-based wire protocol command handlers. Several command handlers (PUSH, ACK, FAIL, BEAT, PUSHB, QUEUE) perform fixed-offset string slicing or indexing without bounds checking, causing Go runtime panics when a bare verb is sent without its expected payload. Because the codebase lacks any recover() wrapper in the command-dispatch path, an unrecovered panic in a handler goroutine terminates the entire Go process rather than just that connection. The attack requires only network access to the command port (default 7419), completion of the trivial HELLO handshake, and no credentials if no password is configured. An attacker can send a single line (e.g., "PUSH" with no payload) to trigger an immediate server crash affecting all clients. This issue is fixed in version 1.10.0.
Affected products
- Faktory Faktory prior to 1.10.0
Timeline
- 2026-08-10: disclosed
- 2026-08-25: patched: Fixed in version 1.10.0