{"id":"CVE-2024-43367","aliases":["RUSTSEC-2024-0444","GHSA-f67q-wr6w-23jq"],"title":"Uncaught exception when transitioning the state of `AsyncGenerator` objects from within a property getter of `then`","summary":"Uncaught exception when transitioning the state of `AsyncGenerator` objects from within a property getter of `then`","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","vendor":"boa_engine","product":"boa_engine","ecosystem":"rust","affected":["boa_engine >= 0.16.0, < 0.19.0"],"patched":["boa_engine 0.19.0"],"published":"2024-08-14","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:06.811772530Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0444","references":[{"url":"https://crates.io/crates/boa_engine"},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0444.html"},{"url":"https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43357"},{"url":"https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7"}],"tags":["osv","rust"],"epss":0.00597,"epssPercentile":0.48367,"ingestedAt":"2026-10-13T11:45:30.174Z","slug":"CVE-2024-43367","body":"## Overview\n\nA wrong assumption made when handling ECMAScript's AsyncGenerator operations\ncan cause an uncaught exception on certain scripts.\n\n## Details\n\nBoa's implementation of AsyncGenerator makes the assumption that the state of\nan AsyncGenerator object cannot change while resolving a promise created by\nmethods of AsyncGenerator such as %AsyncGeneratorPrototype%.next,\n%AsyncGeneratorPrototype%.return, or %AsyncGeneratorPrototype%.throw.\n\nHowever, a carefully constructed code could trigger a state transition from\na getter method for the promise's then property, which causes the engine to\nfail an assertion of this assumption, causing an uncaught exception. This\ncould be used to create a Denial Of Service attack in applications that\nrun arbitrary ECMAScript code provided by an external user.\n\n## Patches\n\nVersion 0.19.0 is patched to correctly handle this case.\n\n## Workarounds\n\nUsers unable to upgrade to the patched version would want to use\nstd::panic::catch_unwind to ensure any exceptions caused by the\nengine don't impact the availability of the main application.\n\n## Affected packages\n\n- `boa_engine >= 0.16.0, < 0.19.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `boa_engine 0.19.0`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}