Weaknesses of type CWE-617

557 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2022-40527HIGHReachable Assertion in WLAN Embedded SWEPSS 0.4%CVE-2022-33254HIGHReachable assertion in ModemEPSS 0.4%CVE-2022-33272HIGHReachable assertion in ModemEPSS 0.4%CVE-2022-33244HIGHReachable assertion in ModemEPSS 0.4%CVE-2022-33250HIGHReachable assertion in ModemEPSS 0.4%CVE-2025-68471MEDIUMAvahi has a reachable assertion in lookup_startEPSS 0.4%CVE-2026-27623HIGHValkey has Pre-Authentication DOS from malformed RESP requestEPSS 0.4%CVE-2026-44319HIGHfree5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)EPSS 0.4%CVE-2026-13058HIGHTransaction Command Insufficient Input Validation Leading to Process TerminationEPSS 0.4%CVE-2026-82065HIGHInsufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted MetadataEPSS 0.4%CVE-2026-18695HIGHImproper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of ServiceEPSS 0.4%CVE-2026-4392MEDIUMTeamSpeak 3 Server clientek Handshake assertionEPSS 0.4%CVE-2026-13055HIGHServer crash via aggregation pipeline expression with compound wildcard index specificationEPSS 0.4%CVE-2026-82068HIGHPersistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of ServiceEPSS 0.4%CVE-2026-115914MEDIUMvLLM DeepSeek-OCR image processing vulnerable to denial of serviceEPSS 0.4%CVE-2026-43853HIGHA vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.EPSS 0.4%CVE-2025-20792MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecEPSS 0.4%CVE-2026-4046HIGHiconv crash due to assertion failure with untrusted inputEPSS 0.4%CVE-2026-104428MEDIUMZebra before 11.0.0 Denial of Service via getblock Verbosity 2EPSS 0.4%CVE-2026-52718MEDIUMGstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusionEPSS 0.4%