CVE-2023-37279

Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.

• CWE-770
• CWE-789
• CWE-770

• https://github.com/contribsys/faktory/security/advisories/GHSA-x4hh-vjm7-g2jvExploit, Vendor Advisory
• https://github.com/contribsys/faktory/security/advisories/GHSA-x4hh-vjm7-g2jvExploit, Vendor Advisory

Published

Sep 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37273Auto-GPT is an experimental open-source application showcasi…8.8
• CVE-2023-37274Auto-GPT is an experimental open-source application showcasi…7.8
• CVE-2023-37275Auto-GPT is an experimental open-source application showcasi…4.3
• CVE-2023-37276aiohttp is an asynchronous HTTP client/server framework for …7.5
• CVE-2023-37277XWiki Platform is a generic wiki platform offering runtime s…9.6
• CVE-2023-37278GLPI is a Free Asset and IT Management Software package, Dat…9.1
• CVE-2023-3728Use after free in WebRTC in Google Chrome prior to 115.0.579…8.8
• CVE-2023-37280Pimcore Admin Classic Bundle provides a Backend UI for Pimco…6.1
• CVE-2023-37281Contiki-NG is an operating system for internet-of-things dev…5.3
• CVE-2023-37282An out-of-bounds write vulnerability exists in the VZT LZMA_…7.8
• CVE-2023-37283Under a very specific and highly unrecommended configuration…9.8
• CVE-2023-37284Improper authentication vulnerability in Archer C20 firmware…8.8