Fallos del tipo CWE-617

556 resultados

Asserção acessível por entrada não confiável

Código de produção contém asserções (assert statements) que podem ser disparadas por dados fornecidos pelo usuário ou atacante, causando falha abrupta da aplicação. Diferente de validação, asserções são mecanismos de debug que não deveriam controlar o fluxo normal — quando acionadas, encerram o programa, provocando negação de serviço.

Ejemplo

Um servidor web recebe um parâmetro `user_id` e executa `assert user_id > 0` antes de consultar o banco. Um atacante envia `user_id=0` ou negativo, a asserção falha e derruba o servidor. O código assume que validação já ocorreu, mas ela não existe.

Cómo mitigar

Substitua asserções por validação explícita com tratamento de erro apropriado (throw exception, retornar código de erro). Remova ou desative asserções em builds de produção. Use asserções apenas para condições internas que nunca deveriam ocorrer, nunca para entrada de usuário.

CVE-2026-92151HIGHF´: SpacePacketDeframer Small Packet Assertion DoSEPSS 0.5%CVE-2026-35058MEDIUMImproper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows EPSS 0.5%CVE-2024-50613MEDIUMlibsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.EPSS 0.5%CVE-2026-92156MEDIUMF´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridgeEPSS 0.5%CVE-2026-78186MEDIUMOpen5GS HSS hss-cx-path.c assertionEPSS 0.5%CVE-2026-92416MEDIUMOpen5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertionEPSS 0.5%CVE-2022-35991MEDIUM`CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in TensorFlowEPSS 0.5%CVE-2022-35935MEDIUM`CHECK` failure in `SobolSample` via missing validation in TensorFlowEPSS 0.5%CVE-2024-45795HIGHSuricata detect/datasets: reachable assertion with unimplemented rule optionEPSS 0.5%CVE-2026-12617HIGHRecord ordering based unexpected exit with CNAME or DNAMEEPSS 0.5%CVE-2026-13204HIGHUnexpected exit in certain situations with NSEC and NSEC3 both presentEPSS 0.5%CVE-2026-108105HIGHOpen5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context RequestEPSS 0.5%CVE-2026-82064HIGHUnauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set MembersEPSS 0.5%CVE-2023-33044HIGHReachable Assertion in Data ModemEPSS 0.5%CVE-2023-33043HIGHReachable Assertion in ModemEPSS 0.5%CVE-2023-37011MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.5%CVE-2023-37010MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.5%CVE-2023-37009MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.5%CVE-2024-24428HIGHA reachable assertion in the oai_nas_5gmm_decode function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafEPSS 0.5%CVE-2026-29115MEDIUMA vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, triggEPSS 0.5%