Falhas do tipo CWE-617
461 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2023-43523HIGHReachable Assertion in WLAN FirmwareEPSS 0.3%CVE-2023-43529HIGHReachable Assertion in Data ModemEPSS 0.3%CVE-2026-30047HIGHA reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial ofEPSS 0.3%CVE-2023-24843HIGHReachable Assertion in ModemEPSS 0.3%CVE-2026-30046HIGHA reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supEPSS 0.3%CVE-2023-33095HIGHReachable Assertion in Multi-Mode Call ProcessorEPSS 0.3%CVE-2026-9748HIGH$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries inputEPSS 0.3%CVE-2023-38473MEDIUMReachable assertion in avahi_alternative_host_nameEPSS 0.3%CVE-2023-38472MEDIUMReachable assertion in avahi_rdata_parseEPSS 0.3%CVE-2023-38470MEDIUMReachable assertion in avahi_escape_labelEPSS 0.3%CVE-2023-38469MEDIUMReachable assertion in avahi_dns_packet_append_recordEPSS 0.3%CVE-2026-30867MEDIUMCocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet ParsingEPSS 0.3%CVE-2026-34067LOWnimiq-transaction vulnerable to panic via `HistoryTreeProof` length mismatchEPSS 0.3%CVE-2025-49088MEDIUMPexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Join, has Improper InputEPSS 0.3%CVE-2026-85534MEDIUMLibsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body readEPSS 0.3%CVE-2026-75894HIGHReachable assertion at ranap_handle_co_dt()EPSS 0.3%CVE-2025-48704HIGHPexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abortEPSS 0.3%CVE-2025-32096HIGHPexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort,EPSS 0.3%CVE-2025-66443HIGHPexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation EPSS 0.3%CVE-2024-7139MEDIUMDenial of Service in Silicon Labs RS9116 Bluetooth SDKEPSS 0.3%