Weaknesses of type CWE-617

557 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2026-10300MEDIUMSGLang Inference HTTP Endpoint lora_manager.py assertionEPSS 0.4%CVE-2026-9750HIGHMetadata name collision on $-prefixed fields causes post-auth server crashEPSS 0.4%CVE-2026-82059MEDIUMImproper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of ServiceEPSS 0.4%CVE-2026-14586MEDIUMAssertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environmentsEPSS 0.4%CVE-2026-13073MEDIUMMongoDB Aggregation Command Invariant Assertion Failure Leading to Process TerminationEPSS 0.4%CVE-2026-92155HIGHF´: FileUplink Unknown Packet Type Assertion DoSEPSS 0.4%CVE-2020-25723—A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing haEPSS 0.4%CVE-2026-44321HIGHfree5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)EPSS 0.4%CVE-2025-46149MEDIUMIn PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.EPSS 0.4%CVE-2026-79379MEDIUMA buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier and fixed EPSS 0.4%CVE-2026-76491HIGHCisco Expressway Series Software Hardening Release: October 2026 - Denial of Service VulnerabilitiesEPSS 0.4%CVE-2025-15497LOWInsufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resultinEPSS 0.4%CVE-2026-121393HIGHFreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region AssertionEPSS 0.4%CVE-2025-41068HIGHReachable Assertion vulnerability in Open5GSEPSS 0.4%CVE-2026-18707MEDIUMImproper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of ServiceEPSS 0.4%CVE-2026-34063HIGHnetwork-libp2p: Peer can crash the node by opening discovery protocol substream twiceEPSS 0.4%CVE-2025-13644HIGHMongoDB may be susceptible to Invariant Failure due to batched deleteEPSS 0.3%CVE-2026-37220HIGHFlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC assumes a mapping between SCTPEPSS 0.3%CVE-2026-37221HIGHFlexRIC v2.0.0 crashes when receiving a RIC_SUBSCRIPTION_RESPONSE with an unknown ric_id that has no corresponding pending event. The near-REPSS 0.3%CVE-2026-50722HIGHIKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payloadEPSS 0.3%