Weaknesses of type CWE-617

461 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2021-41200MEDIUMIncomplete validation in `tf.summary.create_file_writer`EPSS 0.2%CVE-2024-7138MEDIUMDenial of Service in Silicon Labs RS9116 Bluetooth SDKEPSS 0.2%CVE-2026-8843HIGHCalling createIndex with certain index types can crash mongodEPSS 0.2%CVE-2025-12131MEDIUMTruncated 802.15.4 packet leads to denial of serviceEPSS 0.2%CVE-2026-46542MEDIUMnimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve pointsEPSS 0.2%CVE-2026-13058HIGHTransaction Command Insufficient Input Validation Leading to Process TerminationEPSS 0.2%CVE-2025-6273MEDIUMWebAssembly wabt binary-reader-objdump.cc LogOpcode assertionEPSS 0.2%CVE-2025-48019MEDIUMA vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciouEPSS 0.2%CVE-2024-34036MEDIUMAn issue was discovered in O-RAN Near Realtime RIC I-Release. To exploit this vulnerability, an attacker can disrupt the initial connection EPSS 0.2%CVE-2023-29935MEDIUMllvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.EPSS 0.2%CVE-2026-13073MEDIUMMongoDB Aggregation Command Invariant Assertion Failure Leading to Process TerminationEPSS 0.2%CVE-2025-9403MEDIUMjqlang jq JSON jq_test.c run_jq_tests assertionEPSS 0.2%CVE-2024-20147MEDIUMIn Bluetooth FW, there is a possible reachable assertion due to improper exception handling. This could lead to remote denial of service witEPSS 0.2%CVE-2025-6952MEDIUMOpen5GS AMF Service amf-sm.c amf_state_operational assertionEPSS 0.2%CVE-2025-69653MEDIUMA crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70EPSS 0.2%CVE-2026-73438HIGHSecurity Advisory 0172EPSS 0.2%CVE-2026-20405MEDIUMIn Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedEPSS 0.2%CVE-2026-20422MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecEPSS 0.2%CVE-2025-50422LOWCairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_finiEPSS 0.2%CVE-2025-7485MEDIUMOpen5GS SCTP Partial Message recv_handler assertionEPSS 0.2%