Falhas do tipo CWE-617
556 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2026-53532HIGHOpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)EPSS 0.4%CVE-2024-10455HIGHReachable Assertion in µD3TNEPSS 0.4%CVE-2025-24798MEDIUMMeshtastic crashes via an unimplemented routing module replyEPSS 0.4%CVE-2024-8361HIGHDoS caused due to wrong hash length returned for SHA2/224 algorithmEPSS 0.4%CVE-2024-50614MEDIUMTinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterREPSS 0.4%CVE-2026-18697HIGHImproper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongosEPSS 0.4%CVE-2026-37223HIGHFlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-enEPSS 0.4%CVE-2026-47145HIGHColor Control hue/saturation assertion abort in EmberZNet v9.0.2EPSS 0.4%CVE-2026-47146HIGHColor Control color-temperature assertion abort in EmberZNet v9.0.2EPSS 0.4%CVE-2022-25702HIGHDenial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute, SnapdEPSS 0.4%CVE-2022-25673HIGHDenial of service in MODEM due to reachable assertion while processing configuration from network in Snapdragon MobileEPSS 0.4%CVE-2022-25691HIGHDenial of service in Modem due to reachable assertion while processing SIB1 with invalid SCS and bandwidth settings in Snapdragon MobileEPSS 0.4%CVE-2022-25689HIGHDenial of service in Modem due to reachable assertion in Snapdragon MobileEPSS 0.4%CVE-2022-25692HIGHDenial of service in Modem due to reachable assertion while processing the common config procedure in Snapdragon Auto, Snapdragon Compute, SEPSS 0.4%CVE-2022-25672HIGHDenial of service in MODEM due to reachable assertion while processing SIB1 with invalid Bandwidth in Snapdragon MobileEPSS 0.4%CVE-2026-109363HIGHZebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 TransactionEPSS 0.4%CVE-2026-52131HIGHllama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.EPSS 0.4%CVE-2025-41067HIGHReachable Assertion vulnerability in Open5GSEPSS 0.4%CVE-2026-102483HIGHReachable Assertion in ntpsecEPSS 0.4%CVE-2026-37222HIGHFlexRIC v2.0.0 uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages. A remote unauthenticated attaEPSS 0.4%