Weaknesses of type CWE-617

559 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2026-121406MEDIUMFreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX PayloadEPSS 0.2%CVE-2026-46542MEDIUMnimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve pointsEPSS 0.2%CVE-2025-48019MEDIUMA vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciouEPSS 0.2%CVE-2025-8836MEDIUMJasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertionEPSS 0.2%CVE-2025-9403MEDIUMjqlang jq JSON jq_test.c run_jq_tests assertionEPSS 0.2%CVE-2024-34036MEDIUMAn issue was discovered in O-RAN Near Realtime RIC I-Release. To exploit this vulnerability, an attacker can disrupt the initial connection EPSS 0.2%CVE-2023-29935MEDIUMllvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.EPSS 0.2%CVE-2026-76926LOWReachable Assertion in WiresharkEPSS 0.2%CVE-2025-31160LOWatop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecifEPSS 0.2%CVE-2024-20147MEDIUMIn Bluetooth FW, there is a possible reachable assertion due to improper exception handling. This could lead to remote denial of service witEPSS 0.2%CVE-2026-119132MEDIUMWasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused AdapterEPSS 0.2%CVE-2026-5170MEDIUMUsers could trigger a crash of mongod primaries during promotion to shardedEPSS 0.2%CVE-2026-119135MEDIUMWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type MismatchEPSS 0.2%CVE-2026-119139MEDIUMWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::callEPSS 0.2%CVE-2026-34933MEDIUMAvahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemonEPSS 0.2%CVE-2026-20525MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecEPSS 0.2%CVE-2024-56783MEDIUMnetfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup levelEPSS 0.2%CVE-2026-20600MEDIUMIn Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service, if a UE has connected to EPSS 0.2%CVE-2026-8852MEDIUMIBM HTTP Server is affected by multiple vulnerabilitiesEPSS 0.2%CVE-2023-36840MEDIUMJunos OS and Junos OS Evolved: An rpd crash occurs when a specific L2VPN command is runEPSS 0.2%