CVE-2026-63403 Faktory: Unrecovered panic in command handlers allows full-server denial of service

What is CVE-2026-63403?

CVE-2026-63403 is a high-severity denial of service vulnerability in contribsys faktory, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malformed command crashes the entire process. Its wire protocol is line-based, and several command handlers slice or index the received line at a fixed offset, such as cmd[5:] for PUSH or qs[0] for QUEUE, without checking that a payload is present. Sending a bare verb with no payload, for example PUSH, ACK, FAIL, BEAT, PUSHB, or QUEUE, triggers a Go slice or index out-of-range panic. Because the codebase has no recover() anywhere in the command-dispatch path, an unrecovered panic in a handler goroutine terminates the whole Go process rather than just that connection, instantly disconnecting every other client, worker, and in-flight job. The attack requires only a connection to the command port and completion of the trivial handshake, with no credentials when no password is configured, and can be repeated to keep the service down indefinitely. This issue is fixed in version 1.10.0.

Weakness: CWE-248

Which versions are affected by CVE-2026-63403?

How do I fix CVE-2026-63403?

No fix has been published for CVE-2026-63403 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-63403 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63403 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gc57-f6pg-m9h6.