Fallos del tipo CWE-617

461 resultados

Asserção acessível por entrada não confiável

Código de produção contém asserções (assert statements) que podem ser disparadas por dados fornecidos pelo usuário ou atacante, causando falha abrupta da aplicação. Diferente de validação, asserções são mecanismos de debug que não deveriam controlar o fluxo normal — quando acionadas, encerram o programa, provocando negação de serviço.

Ejemplo

Um servidor web recebe um parâmetro `user_id` e executa `assert user_id > 0` antes de consultar o banco. Um atacante envia `user_id=0` ou negativo, a asserção falha e derruba o servidor. O código assume que validação já ocorreu, mas ela não existe.

Cómo mitigar

Substitua asserções por validação explícita com tratamento de erro apropriado (throw exception, retornar código de erro). Remova ou desative asserções em builds de produção. Use asserções apenas para condições internas que nunca deveriam ocorrer, nunca para entrada de usuário.

CVE-2026-82590MEDIUMOpen5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertionEPSS 0.3%CVE-2024-23850MEDIUMIn btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvoluEPSS 0.3%CVE-2026-8674MEDIUMAssertion failure in the DNS stub resolver with a long search domainEPSS 0.3%CVE-2026-62289MEDIUMlibheif: Integer underflow in Fraction constructor via double clap transform applicationEPSS 0.3%CVE-2026-10651HIGHOut-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)EPSS 0.3%CVE-2026-34069MEDIUMnimiq-consensus panics via RequestMacroChain micro-block locatorEPSS 0.3%CVE-2023-31921MEDIUMJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_big_uint_div_mod at jerry-core/ecma/operations/EPSS 0.3%CVE-2026-13122MEDIUMOpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed autheEPSS 0.3%CVE-2026-46543MEDIUMnimiq-blockchain: Genesis batch set requestEPSS 0.3%CVE-2026-20450MEDIUMIn Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connectEPSS 0.3%CVE-2025-20760MEDIUMIn Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote denial of service, if EPSS 0.3%CVE-2025-20762MEDIUMIn Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connectEPSS 0.3%CVE-2026-82064HIGHUnauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set MembersEPSS 0.3%CVE-2024-8354MEDIUMQemu-kvm: usb: assertion failure in usb_ep_get()EPSS 0.3%CVE-2026-18695HIGHImproper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of ServiceEPSS 0.3%CVE-2026-13055HIGHServer crash via aggregation pipeline expression with compound wildcard index specificationEPSS 0.3%CVE-2026-82068HIGHPersistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of ServiceEPSS 0.3%CVE-2023-37008MEDIUMOpen5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causEPSS 0.3%CVE-2026-82065HIGHInsufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted MetadataEPSS 0.3%CVE-2025-27066HIGHReachable Assertion in WLAN FirmwareEPSS 0.3%