CVE-2023-29458: Duktape 2.6 bug crashes JavaScript putting too many values in valstack.

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-13 · updated 2026-06-17
Weakness: CWE-129

Description

Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.

Affected products

Zabbix: 5.0.34, 6.0.17, 6.4.2

References

https://support.zabbix.com/browse/ZBX-22989
https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html
https://support.zabbix.com/browse/ZBX-22989

Get alerted when CVE-2023-29458 or the next vulnerability affects your stack