CVE-2023-29458

Duktape 2.6 bug crashes JavaScript putting too many values in valstack.

State: Published
Severity: 5.9 Medium
Published: Jul 13, 2023
Updated: Nov 3, 2025
Reserved: Apr 6, 2023

Description

Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H	Zabbix

Weaknesses

CWE-129 Improper Validation of Array Index

Affected Products

Product	Versions
ZabbixZabbix	5,0,0 through 5.0.34Affectedfrom 5.0.35rc1Not affected 6,0,0 through 6.0.17Affectedfrom 6.0.18rc1Not affected 6.4.0 through 6.4.2Affectedfrom 6.4.3rc1Not affected 7.0.0alpha1 through 7.0.0alpha1 Affectedfrom 7.0.0alpha1Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.