Weaknesses of type CWE-617

559 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2025-48704HIGHPexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abortEPSS 0.3%CVE-2026-123557HIGHZebra zebrad before 7.0.0 Reachable Assertion DoS via Peer DisconnectionEPSS 0.3%CVE-2024-23850MEDIUMIn btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvoluEPSS 0.3%CVE-2026-27015MEDIUMFreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS)EPSS 0.3%CVE-2026-121389LOWFreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement LoggingEPSS 0.3%CVE-2026-104434HIGHZebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPCEPSS 0.3%CVE-2026-62289MEDIUMlibheif: Integer underflow in Fraction constructor via double clap transform applicationEPSS 0.3%CVE-2025-52964HIGHJunos OS and Junos OS Evolved: Receipt of a specific BGP UPDATE causes an rpd crash on devices with BGP multipath configuredEPSS 0.3%CVE-2026-24826CRITICALOut-of-bounds write in turso3dEPSS 0.3%CVE-2026-10651HIGHOut-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)EPSS 0.3%CVE-2023-31921MEDIUMJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_big_uint_div_mod at jerry-core/ecma/operations/EPSS 0.3%CVE-2026-34069MEDIUMnimiq-consensus panics via RequestMacroChain micro-block locatorEPSS 0.3%CVE-2025-20762MEDIUMIn Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connectEPSS 0.3%CVE-2025-20760MEDIUMIn Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote denial of service, if EPSS 0.3%CVE-2025-56361MEDIUMA reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster'sEPSS 0.3%CVE-2026-46543MEDIUMnimiq-blockchain: Genesis batch set requestEPSS 0.3%CVE-2026-20450MEDIUMIn Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connectEPSS 0.3%CVE-2026-102063HIGHJunos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR link protection is usedEPSS 0.3%CVE-2026-39453HIGHRed Lion Controls N-Tron 700 Series Reachable AssertionEPSS 0.3%CVE-2023-37008MEDIUMOpen5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causEPSS 0.3%