CVE-2023-37279highCWE-770CWE-789

CVE-2023-37279: falha de alta gravidade em contribsys faktory

Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar faktory+ Monitorar github.com/contribsys/faktory

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.9%
Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
contribsys · faktory
CVEs relacionadas — contribsys faktory

No mesmo produto, das mais perigosas para as menos.

CVE-2026-63403HIGHFaktory: Unrecovered panic in command handlers allows full-server denial of serviceEPSS 0.4%CVE-2026-63404HIGHFaktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)EPSS 0.2%