Fallos del tipo CWE-617

557 resultados

Asserção acessível por entrada não confiável

Código de produção contém asserções (assert statements) que podem ser disparadas por dados fornecidos pelo usuário ou atacante, causando falha abrupta da aplicação. Diferente de validação, asserções são mecanismos de debug que não deveriam controlar o fluxo normal — quando acionadas, encerram o programa, provocando negação de serviço.

Ejemplo

Um servidor web recebe um parâmetro `user_id` e executa `assert user_id > 0` antes de consultar o banco. Um atacante envia `user_id=0` ou negativo, a asserção falha e derruba o servidor. O código assume que validação já ocorreu, mas ela não existe.

Cómo mitigar

Substitua asserções por validação explícita com tratamento de erro apropriado (throw exception, retornar código de erro). Remova ou desative asserções em builds de produção. Use asserções apenas para condições internas que nunca deveriam ocorrer, nunca para entrada de usuário.

CVE-2021-43849MEDIUMDoS vulnerabilityEPSS 0.3%CVE-2022-2719MEDIUMIn ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NUEPSS 0.3%CVE-2026-107838HIGHRIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertionEPSS 0.3%CVE-2026-92160MEDIUMF´: SendPartial Integer Overflow Leading to Assertion DoSEPSS 0.3%CVE-2023-31918MEDIUMJerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the parser_parse_function_arguments at jerry-core/parserEPSS 0.3%CVE-2023-31916MEDIUMJerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the jmem_heap_finalize at jerry-core/jmem/jmem-heap.c.EPSS 0.3%CVE-2023-31919MEDIUMJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the jcontext_raise_exception at jerry-core/jcontext/jconEPSS 0.3%CVE-2023-31913MEDIUMJerryscript 3.0 *commit 1a2c047) was discovered to contain an Assertion Failure via the component parser_parse_class at jerry-core/parser/jsEPSS 0.3%CVE-2025-56568HIGHAssertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF (Session Management Function) component of OpeEPSS 0.3%CVE-2026-30867MEDIUMCocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet ParsingEPSS 0.3%CVE-2025-27066HIGHReachable Assertion in WLAN FirmwareEPSS 0.3%CVE-2026-121409HIGHFreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing TokenEPSS 0.3%CVE-2023-38471MEDIUMReachable assertion in dbus_set_host_nameEPSS 0.3%CVE-2023-31920MEDIUMJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm_loop at jerry-core/vm/vm.c.EPSS 0.3%CVE-2024-25445HIGHImproper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure.EPSS 0.3%CVE-2026-15893MEDIUMZephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoSEPSS 0.3%CVE-2026-109946HIGHFreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region WidthEPSS 0.3%CVE-2026-109678HIGHFreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusAEPSS 0.3%CVE-2024-7139MEDIUMDenial of Service in Silicon Labs RS9116 Bluetooth SDKEPSS 0.3%CVE-2023-33095HIGHReachable Assertion in Multi-Mode Call ProcessorEPSS 0.3%