Fallos del tipo CWE-617

556 resultados

Asserção acessível por entrada não confiável

Código de produção contém asserções (assert statements) que podem ser disparadas por dados fornecidos pelo usuário ou atacante, causando falha abrupta da aplicação. Diferente de validação, asserções são mecanismos de debug que não deveriam controlar o fluxo normal — quando acionadas, encerram o programa, provocando negação de serviço.

Ejemplo

Um servidor web recebe um parâmetro `user_id` e executa `assert user_id > 0` antes de consultar o banco. Um atacante envia `user_id=0` ou negativo, a asserção falha e derruba o servidor. O código assume que validação já ocorreu, mas ela não existe.

Cómo mitigar

Substitua asserções por validação explícita com tratamento de erro apropriado (throw exception, retornar código de erro). Remova ou desative asserções em builds de produção. Use asserções apenas para condições internas que nunca deveriam ocorrer, nunca para entrada de usuário.

CVE-2026-109240LOWFreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transferEPSS 0.3%CVE-2025-20791MEDIUMIn Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connectEPSS 0.3%CVE-2025-20752MEDIUMIn Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedEPSS 0.3%CVE-2023-3301MEDIUMTriggerable assertion due to race condition in hot-unplugEPSS 0.3%CVE-2026-84971HIGHPersistent client crash loop via undersized FLE2 insert-update ciphertext in decryption pathEPSS 0.3%CVE-2025-60632MEDIUMAn issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_EPSS 0.3%CVE-2026-102058HIGHJunos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabledEPSS 0.3%CVE-2026-41585MEDIUMZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated ClientsEPSS 0.3%CVE-2025-69653MEDIUMA crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70EPSS 0.3%CVE-2025-50422LOWCairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_finiEPSS 0.3%CVE-2026-119138MEDIUMWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After TrapEPSS 0.3%CVE-2026-121394HIGHFreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoderEPSS 0.3%CVE-2026-121395HIGHFreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX DecoderEPSS 0.3%CVE-2026-119142MEDIUMWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async DropEPSS 0.3%CVE-2024-23385HIGHReachable Assertion in ModemEPSS 0.3%CVE-2026-19395MEDIUMAn empty <img> attribute value in styled text triggers a parser error that halts the device.EPSS 0.3%CVE-2026-120956HIGHremote abort and memory disclosure from a malformed cursor.nsEPSS 0.3%CVE-2026-101964HIGHJunos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP messageEPSS 0.3%CVE-2025-7485MEDIUMOpen5GS SCTP Partial Message recv_handler assertionEPSS 0.2%CVE-2024-7138MEDIUMDenial of Service in Silicon Labs RS9116 Bluetooth SDKEPSS 0.2%