CVE-2024-43367

Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assumption made when handling ECMAScript's `AsyncGenerator` operations can cause an uncaught exception on certain scripts. Boa's implementation of `AsyncGenerator` makes the assumption that the state of an `AsyncGenerator` object cannot change while resolving a promise created by methods of `AsyncGenerator` such as `%AsyncGeneratorPrototype%.next`, `%AsyncGeneratorPrototype%.return`, or `%AsyncGeneratorPrototype%.throw`. However, a carefully constructed code could trigger a state transition from a getter method for the promise's `then` property, which causes the engine to fail an assertion of this assumption, causing an uncaught exception. This could be used to create a Denial Of Service attack in applications that run arbitrary ECMAScript code provided by an external user. Version 0.19.0 is patched to correctly handle this case. Users unable to upgrade to the patched version would want to use `std::panic::catch_unwind` to ensure any exceptions caused by the engine don't impact the availability of the main application.

• CWE-248

• https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7
• https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq
• https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r

Published

Aug 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43360ZoneMinder is a free, open source closed-circuit television …9.8
• CVE-2024-43362Cacti is an open source performance and fault management fra…5.4
• CVE-2024-43363Cacti is an open source performance and fault management fra…7.2
• CVE-2024-43364Cacti is an open source performance and fault management fra…8.2
• CVE-2024-43365Cacti is an open source performance and fault management fra…8.2
• CVE-2024-43366zkvyper is a Vyper compiler. Starting in version 1.3.12 and …9.1
• CVE-2024-43368The Trix editor, versions prior to 2.1.4, is vulnerable to X…6.5
• CVE-2024-43369Ibexa RichText Field Type is a Field Type for supporting ric…7.2
• CVE-2024-4337Adive Framework 2.0.8, does not sufficiently encode user-con…7.4
• CVE-2024-43370gettext.js is a GNU gettext port for node and the browser. T…7.2
• CVE-2024-43371CKAN is an open-source data management system for powering d…6.5
• CVE-2024-43372Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…