Falhas do tipo CWE-617
557 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2026-50721HIGHIKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payloadEPSS 0.4%CVE-2022-35205MEDIUMAn issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause aEPSS 0.4%CVE-2023-24843HIGHReachable Assertion in ModemEPSS 0.4%CVE-2022-40508HIGHReachable assertion in ModemEPSS 0.4%CVE-2023-21653HIGHReachable Assertion in ModemEPSS 0.4%CVE-2022-33251HIGHReachable assertion in ModemEPSS 0.4%CVE-2022-40538HIGHReachable assertion in ModemEPSS 0.4%CVE-2022-40504HIGHReachable assertion in ModemEPSS 0.4%CVE-2022-34144HIGHReachable assertion in ModemEPSS 0.4%CVE-2023-21646HIGHReachable Assertion in ModemEPSS 0.4%CVE-2022-22060HIGHReachable Assertion in ModemEPSS 0.4%CVE-2026-91951HIGHFreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrcEPSS 0.4%CVE-2025-68468MEDIUMAvahi has a reachable assertion in lookup_multicast_callbackEPSS 0.4%CVE-2025-59029MEDIUMInternal logic flaw in cache management can lead to a denial of service in PowerDNS RecursorEPSS 0.4%CVE-2026-102064HIGHJunos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is usedEPSS 0.4%CVE-2021-3502—A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to EPSS 0.4%CVE-2026-19519MEDIUMClaircore: claircore: denial of service via unchecked type assertion in rpm header parserEPSS 0.4%CVE-2025-66379HIGHPexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abortEPSS 0.4%CVE-2026-91961HIGHFreeRDP before 3.31.0 Denial of Service via URBDRCEPSS 0.4%CVE-2026-41485HIGHKyverno Controller Denial of Service via forEach Mutation PanicEPSS 0.4%