Weaknesses of type CWE-617
461 resultsAsserção Acessível
É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.
Example
Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.
How to mitigate
Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).
CVE-2024-33255MEDIUMJerryscript commit cefd391 was discovered to contain an Assertion Failure via ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p) in ecma_free_strinEPSS 0.3%CVE-2026-48852LOWPuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.EPSS 0.3%CVE-2026-19519MEDIUMClaircore: claircore: denial of service via unchecked type assertion in rpm header parserEPSS 0.3%CVE-2026-33952MEDIUMFreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checksEPSS 0.3%CVE-2026-9749HIGHUsing MaxKey() may crash the serverEPSS 0.3%CVE-2026-9746HIGHServer crashes in case of the use of exchangeEPSS 0.3%CVE-2026-9747HIGHCrafted cross-shard merge aggregation crashes MongoDB ServerEPSS 0.3%CVE-2026-14586MEDIUMAssertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environmentsEPSS 0.3%CVE-2026-24826CRITICALOut-of-bounds write in turso3dEPSS 0.3%CVE-2026-41584CRITICALZEBRA: rk Identity Point Panic in Transaction VerificationEPSS 0.3%CVE-2023-37004MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37005MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2024-24432MEDIUMA reachable assertion in the ogs_kdf_hash_mme function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a craftedEPSS 0.3%CVE-2023-37012MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37006MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37003MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37007MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37002MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2026-53532HIGHOpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)EPSS 0.3%CVE-2025-52964HIGHJunos OS and Junos OS Evolved: Receipt of a specific BGP UPDATE causes an rpd crash on devices with BGP multipath configuredEPSS 0.3%