Faktory, a language‑agnostic background job server, contains a flaw where certain command handlers perform unsanitized slicing or indexing of incoming messages. When a client sends a bare verb such as PUSH or QUEUE without the expected payload, the Go runtime panics due to an out‑of‑range index. Because the server’s dispatch path contains no recover logic, the panic propagates to the entire process, shutting down Faktory and disconnecting every connected client. This results in a complete denial of service that can be repeatedly triggered without authentication or any credentials.

All Faktory installations running versions earlier than 1.10.0 are vulnerable. The affected product is Contribsys Faktory; no specific sub‑component version data is provided beyond the mention that the issue is fixed in 1.10.0.

The CVSS score of 8.7 reflects a high severity for a denial‑of‑service vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs to establish an unauthenticated connection to Faktory’s command port and perform a trivial handshake to trigger the panic. Because the flaw does not require privileged credentials, it can be abused from any network location that can reach the port, and the service remains down until a restart or code update occurs. If an organization relies on Faktory for critical job processing, this vulnerability poses a significant availability risk to operations.