CVE-2023-29458 Duktape 2.6 bug crashes JavaScript putting too many values in valstack.

Medium 5.9 Published 13 Jul 2023 Updated 3 Nov 2025

An attacker can cause a denial of service by triggering a crash in the Duktape JavaScript engine through excessive stack values.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-29458?

CVE-2023-29458 is a medium-severity denial of service vulnerability in Zabbix Zabbix, published on 13 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.

Weakness: CWE-129

Which versions are affected by CVE-2023-29458?

It affects 1 product.

Products include Zabbix Zabbix.

How do I fix CVE-2023-29458?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-29458 being exploited?

There is no known exploitation of CVE-2023-29458 in the wild and no public exploit code.

All Zabbix Zabbix vulnerabilities

Sources

Also known as DEBIAN-CVE-2023-29458, GHSA-7rx9-h3cp-pvq7, UBUNTU-CVE-2023-29458.