Weaknesses of type CWE-617

559 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2026-103100HIGHPexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigEPSS 0.3%CVE-2025-20752MEDIUMIn Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedEPSS 0.3%CVE-2026-109240LOWFreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transferEPSS 0.3%CVE-2025-20791MEDIUMIn Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connectEPSS 0.3%CVE-2026-84971HIGHPersistent client crash loop via undersized FLE2 insert-update ciphertext in decryption pathEPSS 0.3%CVE-2023-3301MEDIUMTriggerable assertion due to race condition in hot-unplugEPSS 0.3%CVE-2025-60632MEDIUMAn issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_EPSS 0.3%CVE-2026-102058HIGHJunos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabledEPSS 0.3%CVE-2026-41585MEDIUMZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated ClientsEPSS 0.3%CVE-2025-69653MEDIUMA crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70EPSS 0.3%CVE-2025-27073HIGHReachable Assertion in WLAN FirmwareEPSS 0.3%CVE-2025-50422LOWCairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_finiEPSS 0.3%CVE-2024-23385HIGHReachable Assertion in ModemEPSS 0.3%CVE-2026-119138MEDIUMWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After TrapEPSS 0.3%CVE-2026-119142MEDIUMWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async DropEPSS 0.3%CVE-2026-121395HIGHFreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX DecoderEPSS 0.3%CVE-2026-121394HIGHFreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoderEPSS 0.3%CVE-2026-19395MEDIUMAn empty <img> attribute value in styled text triggers a parser error that halts the device.EPSS 0.3%CVE-2026-120956HIGHremote abort and memory disclosure from a malformed cursor.nsEPSS 0.3%CVE-2026-101964HIGHJunos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP messageEPSS 0.3%