Weaknesses of type CWE-617

460 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2025-5520MEDIUMOpen5GS AMF/MME emm_state_authentication assertionEPSS 0.9%CVE-2025-46354HIGHA denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloomberg Comdb2 8.1. A specEPSS 0.8%CVE-2022-23579MEDIUM`CHECK`-failures during Grappler's `SafeToRemoveIdentity` in TensorflowEPSS 0.8%CVE-2022-23586MEDIUMMultiple `CHECK`-fails in `function.cc` in TensorflowEPSS 0.8%CVE-2021-1440MEDIUMCisco IOS XR Software BGP Resource Public Key Infrastructure Denial of Service VulnerabilityEPSS 0.8%CVE-2025-20666MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.8%CVE-2025-15531MEDIUMOpen5GS context.c sgwc_bearer_add assertionEPSS 0.8%CVE-2025-15530MEDIUMOpen5GS s11-handler.c assertionEPSS 0.8%CVE-2022-23582MEDIUM`CHECK`-failures in `TensorByteSize` in TensorflowEPSS 0.8%CVE-2025-8804MEDIUMOpen5GS AMF ngap_build_downlink_nas_transport assertionEPSS 0.8%CVE-2023-37021HIGHOpen5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.8%CVE-2023-37019HIGHOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An EPSS 0.8%CVE-2023-37017HIGHOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.8%CVE-2024-24430HIGHA reachable assertion in the mme_ue_find_by_imsi function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafEPSS 0.8%CVE-2023-37016HIGHOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.8%CVE-2023-37020HIGHOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.8%CVE-2023-37023HIGHOpen5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. A packet missing its `MME_UE_S1AP_EPSS 0.8%CVE-2024-34235HIGHOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An EPSS 0.8%CVE-2023-37018HIGHOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An EPSS 0.8%CVE-2023-37015HIGHOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An EPSS 0.8%