Falhas do tipo CWE-617
557 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2022-33250HIGHReachable assertion in ModemEPSS 0.4%CVE-2022-40527HIGHReachable Assertion in WLAN Embedded SWEPSS 0.4%CVE-2022-33272HIGHReachable assertion in ModemEPSS 0.4%CVE-2022-33254HIGHReachable assertion in ModemEPSS 0.4%CVE-2022-33244HIGHReachable assertion in ModemEPSS 0.4%CVE-2026-27623HIGHValkey has Pre-Authentication DOS from malformed RESP requestEPSS 0.4%CVE-2025-68471MEDIUMAvahi has a reachable assertion in lookup_startEPSS 0.4%CVE-2026-44319HIGHfree5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)EPSS 0.4%CVE-2026-18695HIGHImproper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of ServiceEPSS 0.4%CVE-2026-82065HIGHInsufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted MetadataEPSS 0.4%CVE-2026-13055HIGHServer crash via aggregation pipeline expression with compound wildcard index specificationEPSS 0.4%CVE-2026-13058HIGHTransaction Command Insufficient Input Validation Leading to Process TerminationEPSS 0.4%CVE-2026-82068HIGHPersistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of ServiceEPSS 0.4%CVE-2026-4392MEDIUMTeamSpeak 3 Server clientek Handshake assertionEPSS 0.4%CVE-2026-115914MEDIUMvLLM DeepSeek-OCR image processing vulnerable to denial of serviceEPSS 0.4%CVE-2026-43853HIGHA vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.EPSS 0.4%CVE-2025-20792MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecEPSS 0.4%CVE-2026-4046HIGHiconv crash due to assertion failure with untrusted inputEPSS 0.4%CVE-2026-104428MEDIUMZebra before 11.0.0 Denial of Service via getblock Verbosity 2EPSS 0.4%CVE-2026-52718MEDIUMGstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusionEPSS 0.4%