Faktory versions prior to 1.10.0 are vulnerable to an unauthenticated denial of service attack that can crash the entire background job server process.

The application fails to handle malformed commands correctly, leading to an uncaught exception (panic) when a command is sent without a required payload. Because the command-dispatch path lacks proper recovery mechanisms, this panic terminates the entire Go process, allowing any unauthenticated network attacker to repeatedly shut down the service.

The ability for an attacker to remotely crash the Faktory server creates a severe risk of service disruption. As Faktory is typically used for background job processing, an ongoing denial of service would prevent critical business tasks, such as email delivery, report generation, or data synchronization, from completing. With a CVSS score of 8.7, this vulnerability represents a high-severity threat to operational continuity.

Immediate Action: Upgrade Faktory to version 1.10.0 or later immediately to incorporate the necessary exception handling and process stability improvements.

Proactive Monitoring: Monitor server logs for repeated connection attempts followed by unexpected process termination or service restarts.

Compensating Controls: Ensure the Faktory command port is restricted to trusted internal networks via firewall rules to limit exposure to unauthorized attackers.

Public Exploit Available: No (exploit_available: unknown)

The vulnerability poses a significant risk to the availability of infrastructure relying on Faktory for task orchestration. Administrators should prioritize upgrading to version 1.10.0 to prevent potential service outages caused by malicious actors or automated scanning tools.