Weaknesses of type CWE-617

461 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2026-91951HIGHFreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrcEPSS 0.3%CVE-2025-15497LOWInsufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resultinEPSS 0.3%CVE-2022-2719MEDIUMIn ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NUEPSS 0.3%CVE-2023-31913MEDIUMJerryscript 3.0 *commit 1a2c047) was discovered to contain an Assertion Failure via the component parser_parse_class at jerry-core/parser/jsEPSS 0.3%CVE-2023-31918MEDIUMJerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the parser_parse_function_arguments at jerry-core/parserEPSS 0.3%CVE-2023-31919MEDIUMJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the jcontext_raise_exception at jerry-core/jcontext/jconEPSS 0.3%CVE-2023-31916MEDIUMJerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the jmem_heap_finalize at jerry-core/jmem/jmem-heap.c.EPSS 0.3%CVE-2026-52856HIGHWings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceEPSS 0.3%CVE-2026-43667MEDIUMA reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadEPSS 0.3%CVE-2021-43849MEDIUMDoS vulnerabilityEPSS 0.3%CVE-2025-56568HIGHAssertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF (Session Management Function) component of OpeEPSS 0.3%CVE-2026-18697HIGHImproper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongosEPSS 0.3%CVE-2023-38471MEDIUMReachable assertion in dbus_set_host_nameEPSS 0.3%CVE-2025-41068HIGHReachable Assertion vulnerability in Open5GSEPSS 0.3%CVE-2026-91147MEDIUMCockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slashEPSS 0.3%CVE-2023-31920MEDIUMJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm_loop at jerry-core/vm/vm.c.EPSS 0.3%CVE-2025-13644HIGHMongoDB may be susceptible to Invariant Failure due to batched deleteEPSS 0.3%CVE-2026-62377MEDIUMlibheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)EPSS 0.3%CVE-2024-25445HIGHImproper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure.EPSS 0.3%CVE-2023-33096HIGHReachable Assertion in Multi-Mode Call ProcessorEPSS 0.3%