Weaknesses of type CWE-617

460 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2026-27135HIGHnghttp2 Denial of service: Assertion failure due to the missing state validationEPSS 0.8%CVE-2025-5501MEDIUMOpen5GS NGAP PathSwitchRequest Message ngap-handler.c ngap_handle_path_switch_request_transfer assertionEPSS 0.8%CVE-2024-20094HIGHIn Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional exeEPSS 0.8%CVE-2024-53429HIGHOpen62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash.EPSS 0.7%CVE-2023-34868HIGHJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start at jerry-core/parseEPSS 0.7%CVE-2024-31744HIGHIn Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attEPSS 0.7%CVE-2023-34867HIGHJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_property_hashmap_create at jerry-core/ecma/baseEPSS 0.7%CVE-2020-15197MEDIUMDenial of Service in TensorflowEPSS 0.7%CVE-2023-37024HIGHA reachable assertion in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fEPSS 0.7%CVE-2023-23759HIGHThere is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requiresEPSS 0.7%CVE-2022-35941MEDIUM`CHECK` failure in `AvgPoolOp` in TensorflowEPSS 0.7%CVE-2022-35952MEDIUM`CHECK` failures in `UnbatchGradOp` in TensorFlowEPSS 0.7%CVE-2024-39697HIGHphonenumber panics on parsing crafted phonenumber inputsEPSS 0.7%CVE-2022-35960MEDIUM`CHECK` failure in `TensorListReserve` in TensorFlowEPSS 0.7%CVE-2022-36012MEDIUMAssertion fail on MLIR empty edge names in TensorFlowEPSS 0.7%CVE-2022-36016MEDIUM`CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs` in TensorFlowEPSS 0.7%CVE-2026-1738MEDIUMOpen5GS SGWC context.c sgwc_tunnel_add assertionEPSS 0.7%CVE-2024-32475HIGHEnvoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytesEPSS 0.7%CVE-2024-8768HIGHVllm: a completions api request with an empty prompt will crash the vllm api server.EPSS 0.7%CVE-2026-20401MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.7%