Weaknesses of type CWE-617

460 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2021-20286—A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of service.EPSS 1.1%CVE-2022-26446HIGHIn Modem 4G RRC, there is a possible system crash due to improper input validation. This could lead to remote denial of service, when concatEPSS 1.1%CVE-2021-32815MEDIUMDenial of service due to assertion failure in crwimage_int.cppEPSS 1.1%CVE-2019-5020MEDIUMAn exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can EPSS 1.1%CVE-2024-33601HIGHnscd: netgroup cache may terminate daemon on memory allocation failureEPSS 1.1%CVE-2023-39949HIGHImproper validation of sequence numbers leading to remotely reachable assertion failureEPSS 1.0%CVE-2023-39534HIGHMalformed GAP submessage triggers assertion failureEPSS 1.0%CVE-2020-15194MEDIUMDenial of Service in TensorflowEPSS 1.0%CVE-2019-14851—A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertEPSS 1.0%CVE-2021-3454MEDIUMTruncated L2CAP K-frame causes assertion failureEPSS 1.0%CVE-2022-24272MEDIUMMongoDB Server (mongod) may crash in response to unexpected requestsEPSS 0.9%CVE-2023-5871MEDIUMLibnbd: malicious nbd server may crash libnbdEPSS 0.9%CVE-2025-40777HIGHA possible assertion failure when 'stale-answer-client-timeout' is set to '0'EPSS 0.9%CVE-2026-41523HIGHvLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code ExecutionEPSS 0.9%CVE-2021-3431MEDIUMBT: Assertion failure on repeated LL_FEATURE_REQEPSS 0.9%CVE-2021-3430MEDIUMBT: Assertion failure on repeated LL_CONNECTION_PARAM_REQEPSS 0.9%CVE-2022-23583MEDIUM`CHECK`-failures in binary ops in TensorflowEPSS 0.9%CVE-2023-40462HIGHImproper input leads to DoSEPSS 0.9%CVE-2022-23588MEDIUM`CHECK`-fails due to attempting to build a reference tensor in TensorflowEPSS 0.9%CVE-2022-31100MEDIUMReachable Assertion in rulexEPSS 0.9%