Weaknesses of type CWE-617

556 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2026-91147MEDIUMCockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slashEPSS 0.6%CVE-2026-116467MEDIUMggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertionEPSS 0.6%CVE-2024-24420HIGHA reachable assertion in the decode_linked_ti_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) EPSS 0.6%CVE-2026-89146HIGHlibp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery ResponsesEPSS 0.6%CVE-2026-78048HIGHApache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK DecoderEPSS 0.6%CVE-2026-94623HIGHvLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion FailureEPSS 0.6%CVE-2026-37229HIGHFlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attackeEPSS 0.6%CVE-2025-15176MEDIUMOpen5GS PFCP Session Establishment Request rule-match.c ogs_pfcp_pdr_rule_find_by_packet assertionEPSS 0.6%CVE-2023-44175MEDIUMJunos OS and Junos OS Evolved: Receipt of a specific genuine PIM packet causes RPD crashEPSS 0.6%CVE-2025-46705HIGHA denial of service vulnerability exists in the g_assert_not_reached functionality of Entr&#39;ouvert Lasso 2.5.1 and 2.8.2. A specially craEPSS 0.6%CVE-2024-34475HIGHOpen5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm_state_authenticationEPSS 0.6%CVE-2026-55776MEDIUMOpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesEPSS 0.6%CVE-2026-52829HIGHZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address BookEPSS 0.6%CVE-2026-52856HIGHWings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceEPSS 0.6%CVE-2026-75584HIGHION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() AssertionEPSS 0.6%CVE-2026-2523MEDIUMOpen5GS SMF gn-handler.c smf_gn_handle_create_pdp_context_request assertionEPSS 0.6%CVE-2026-12413HIGHIKEv2 Denial of Service via malformed fragmentationEPSS 0.6%CVE-2024-47522HIGHSuricata ja4: invalid alpn leads to panicEPSS 0.6%CVE-2025-14954MEDIUMOpen5GS QER/FAR/URR/PDR context.c ogs_pfcp_qer_find_or_add assertionEPSS 0.6%CVE-2025-36512HIGHA denial of service vulnerability exists in the Bloomberg Comdb2 8.1 database when handling a distributed transaction heartbeat. A speciallyEPSS 0.6%