{"id":"RUSTSEC-2024-0444","revision":"16196083614540d8be7c8eecf185c04f","records":[{"revision":"16196083614540d8be7c8eecf185c04f","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2024-0444","aliases":["CVE-2024-43367","GHSA-f67q-wr6w-23jq"],"title":"Uncaught exception when transitioning the state of `AsyncGenerator` objects from within a property getter of `then`","description":"A wrong assumption made when handling ECMAScript's AsyncGenerator operations\ncan cause an uncaught exception on certain scripts.\n\n## Details\n\nBoa's implementation of AsyncGenerator makes the assumption that the state of\nan AsyncGenerator object cannot change while resolving a promise created by\nmethods of AsyncGenerator such as %AsyncGeneratorPrototype%.next,\n%AsyncGeneratorPrototype%.return, or %AsyncGeneratorPrototype%.throw.\n\nHowever, a carefully constructed code could trigger a state transition from\na getter method for the promise's then property, which causes the engine to\nfail an assertion of this assumption, causing an uncaught exception. This\ncould be used to create a Denial Of Service attack in applications that\nrun arbitrary ECMAScript code provided by an external user.\n\n## Patches\n\nVersion 0.19.0 is patched to correctly handle this case.\n\n## Workarounds\n\nUsers unable to upgrade to the patched version would want to use\nstd::panic::catch_unwind to ensure any exceptions caused by the\nengine don't impact the availability of the main application.","state":0,"publishedAt":"2024-08-14T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:06.8117725+00:00","affected":[{"ecosystem":"crates.io","name":"boa_engine","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.16.0"},{"kind":"fixed","version":"0.19.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/boa_engine","https://rustsec.org/advisories/RUSTSEC-2024-0444.html","https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7","https://nvd.nist.gov/vuln/detail/CVE-2024-43357"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0444","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2024-0444","identifiers":["RUSTSEC-2024-0444","CVE-2024-43367","GHSA-f67q-wr6w-23jq"]},"retained":false,"historicalAffected":[]}],"coverage":[]}