Weaknesses of type CWE-617

556 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2022-20694MEDIUMCisco IOS XE Software Border Gateway Protocol Resource Public Key Infrastructure Denial of Service VulnerabilityEPSS 1.2%CVE-2022-48363HIGHIn MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain sEPSS 1.2%CVE-2022-23581MEDIUM`CHECK`-failures during Grappler's `IsSimplifiableReshape` in TensorflowEPSS 1.2%CVE-2021-20286—A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of service.EPSS 1.1%CVE-2023-5871MEDIUMLibnbd: malicious nbd server may crash libnbdEPSS 1.1%CVE-2021-32815MEDIUMDenial of service due to assertion failure in crwimage_int.cppEPSS 1.1%CVE-2019-5020MEDIUMAn exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can EPSS 1.1%CVE-2024-33601HIGHnscd: netgroup cache may terminate daemon on memory allocation failureEPSS 1.1%CVE-2023-39534HIGHMalformed GAP submessage triggers assertion failureEPSS 1.0%CVE-2023-39949HIGHImproper validation of sequence numbers leading to remotely reachable assertion failureEPSS 1.0%CVE-2022-24272MEDIUMMongoDB Server (mongod) may crash in response to unexpected requestsEPSS 1.0%CVE-2026-45815HIGHApache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handlerEPSS 1.0%CVE-2020-15194MEDIUMDenial of Service in TensorflowEPSS 1.0%CVE-2025-40777HIGHA possible assertion failure when 'stale-answer-client-timeout' is set to '0'EPSS 1.0%CVE-2019-14851—A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertEPSS 1.0%CVE-2021-3454MEDIUMTruncated L2CAP K-frame causes assertion failureEPSS 1.0%CVE-2026-56388CRITICALApache bRPC: Out-of-Bounds Write in Redis Command ParserEPSS 1.0%CVE-2021-3431MEDIUMBT: Assertion failure on repeated LL_FEATURE_REQEPSS 0.9%CVE-2021-3430MEDIUMBT: Assertion failure on repeated LL_CONNECTION_PARAM_REQEPSS 0.9%CVE-2026-41523HIGHvLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code ExecutionEPSS 0.9%