Weaknesses of type CWE-617

556 results

Asserção Acessível

É quando uma asserção (verificação de condição de debug) fica acessível em código de produção e pode ser acionada por entrada malformada ou não esperada. Se a asserção falha, o programa termina abruptamente, causando negação de serviço. O risco está em expor lógica de depuração que não deveria ser pública.

Example

Um servidor web com assert(tamanho_arquivo < 1GB) no meio do processamento de upload. Um atacante envia arquivo gigante, a asserção é acionada e o serviço cai. Usuários legítimos perdem acesso.

How to mitigate

Use exceções tratadas e validações explícitas em vez de asserções para entradas de usuários. Remova ou desative asserções em builds de produção; use flags de compilação (-DNDEBUG em C/C++, ou não incluir asserções no jar final em Java).

CVE-2024-42644HIGHFlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS EPSS 0.6%CVE-2024-42645HIGHAn issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leading to a Denial of ServEPSS 0.6%CVE-2026-3119MEDIUMAuthenticated query containing a TKEY record may cause named to terminate unexpectedlyEPSS 0.6%CVE-2024-45396HIGHQuicly assertion failuresEPSS 0.6%CVE-2026-92157MEDIUMF´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertionEPSS 0.6%CVE-2026-1737MEDIUMOpen5GS CreateBearerRequest s5c-handler.c sgwc_s5c_handle_create_bearer_request assertionEPSS 0.6%CVE-2024-24429HIGHA reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a EPSS 0.6%CVE-2026-34219HIGHlibp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant OverflowEPSS 0.6%CVE-2026-23991MEDIUMgo-tuf affected by client DoS via malformed server responseEPSS 0.6%CVE-2026-102012HIGHJunos OS Evolved: An attacker causes na-grpcd to crash when gRPC telemetry is enabledEPSS 0.6%CVE-2026-80274HIGHValidating resolver can abort while caching a mismatched NOQNAME proofEPSS 0.6%CVE-2026-76163HIGHnamed aborts on a TKEY query when the user configuration has no global options statementEPSS 0.6%CVE-2026-66754HIGHRouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encodingEPSS 0.6%CVE-2026-119843MEDIUMGst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tagsEPSS 0.6%CVE-2024-39949HIGHA vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, cEPSS 0.6%CVE-2026-121960HIGHFreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequestEPSS 0.6%CVE-2026-92150HIGHF´: GenericHub Malformed Buffer Assertion DoSEPSS 0.6%CVE-2026-29116HIGHA vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially crafted packet, triEPSS 0.6%CVE-2023-37013HIGHOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a sufficiently large ASN.1 packet over the S1AP interEPSS 0.5%CVE-2026-82590MEDIUMOpen5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertionEPSS 0.5%