Falhas do tipo CWE-617
460 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2026-10822MEDIUMKey Record using PRIVATEDNS algorithm may lead to unexpected exitEPSS 0.4%CVE-2021-3502—A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to EPSS 0.4%CVE-2025-59029MEDIUMInternal logic flaw in cache management can lead to a denial of service in PowerDNS RecursorEPSS 0.4%CVE-2025-66379HIGHPexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abortEPSS 0.4%CVE-2026-41485HIGHKyverno Controller Denial of Service via forEach Mutation PanicEPSS 0.4%CVE-2026-9750HIGHMetadata name collision on $-prefixed fields causes post-auth server crashEPSS 0.4%CVE-2026-10300MEDIUMSGLang Inference HTTP Endpoint lora_manager.py assertionEPSS 0.4%CVE-2025-20792MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecEPSS 0.4%CVE-2020-25723—A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing haEPSS 0.4%CVE-2026-44321HIGHfree5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)EPSS 0.4%CVE-2025-46149MEDIUMIn PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.EPSS 0.4%CVE-2026-29115MEDIUMA vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, triggEPSS 0.4%CVE-2026-27623HIGHValkey has Pre-Authentication DOS from malformed RESP requestEPSS 0.4%CVE-2026-19401HIGHRemote UDP DoS by sending multiple DNS Cookie optionsEPSS 0.4%CVE-2026-34063HIGHnetwork-libp2p: Peer can crash the node by opening discovery protocol substream twiceEPSS 0.4%CVE-2026-82052HIGH$regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 charsEPSS 0.4%CVE-2026-37220HIGHFlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC assumes a mapping between SCTPEPSS 0.3%CVE-2026-37221HIGHFlexRIC v2.0.0 crashes when receiving a RIC_SUBSCRIPTION_RESPONSE with an unknown ric_id that has no corresponding pending event. The near-REPSS 0.3%CVE-2026-50722HIGHIKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payloadEPSS 0.3%CVE-2026-91961HIGHFreeRDP before 3.31.0 Denial of Service via URBDRCEPSS 0.3%