Weaknesses of type CWE-617

460 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2026-47145HIGHColor Control hue/saturation assertion abort in EmberZNet v9.0.2EPSS 0.4%CVE-2026-47146HIGHColor Control color-temperature assertion abort in EmberZNet v9.0.2EPSS 0.4%CVE-2026-52829HIGHZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address BookEPSS 0.4%CVE-2026-75584HIGHION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() AssertionEPSS 0.4%CVE-2025-15684MEDIUMOpen5GS CER init.c diam_log_func assertionEPSS 0.4%CVE-2026-37222HIGHFlexRIC v2.0.0 uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages. A remote unauthenticated attaEPSS 0.4%CVE-2026-37224HIGHFlexRIC v2.0.0 crashes when receiving a duplicate E2_SETUP_REQUEST from the same or spoofed E2 Node. The iApp registry enforces node ID uniqEPSS 0.4%CVE-2025-65559HIGHAn issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with aEPSS 0.4%CVE-2026-90786MEDIUMDvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertionEPSS 0.4%CVE-2026-9718MEDIUMCWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impactEPSS 0.4%CVE-2024-8361HIGHDoS caused due to wrong hash length returned for SHA2/224 algorithmEPSS 0.4%CVE-2026-89146HIGHlibp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery ResponsesEPSS 0.4%CVE-2025-32095HIGHPexip Infinity before 37.0 has improper input validation in signalling that allows a remote attacker to trigger a software abort via a craftEPSS 0.4%CVE-2025-22919MEDIUMA reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a craEPSS 0.4%CVE-2026-90785MEDIUMDvidelabs flatcc Struct Analysis semantics.c analyze_struct assertionEPSS 0.4%CVE-2025-54350LOWIn iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt.EPSS 0.4%CVE-2024-50614MEDIUMTinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterREPSS 0.4%CVE-2017-12168—The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause EPSS 0.4%CVE-2026-37227HIGHFlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near-EPSS 0.4%CVE-2026-37225HIGHFlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition field. The E42 layer dEPSS 0.4%