Falhas do tipo CWE-617
461 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2026-82590MEDIUMOpen5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertionEPSS 0.3%CVE-2024-23850MEDIUMIn btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvoluEPSS 0.3%CVE-2026-8674MEDIUMAssertion failure in the DNS stub resolver with a long search domainEPSS 0.3%CVE-2026-62289MEDIUMlibheif: Integer underflow in Fraction constructor via double clap transform applicationEPSS 0.3%CVE-2026-10651HIGHOut-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)EPSS 0.3%CVE-2026-34069MEDIUMnimiq-consensus panics via RequestMacroChain micro-block locatorEPSS 0.3%CVE-2023-31921MEDIUMJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_big_uint_div_mod at jerry-core/ecma/operations/EPSS 0.3%CVE-2026-13122MEDIUMOpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed autheEPSS 0.3%CVE-2026-46543MEDIUMnimiq-blockchain: Genesis batch set requestEPSS 0.3%CVE-2026-20450MEDIUMIn Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connectEPSS 0.3%CVE-2025-20760MEDIUMIn Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote denial of service, if EPSS 0.3%CVE-2025-20762MEDIUMIn Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connectEPSS 0.3%CVE-2026-82064HIGHUnauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set MembersEPSS 0.3%CVE-2024-8354MEDIUMQemu-kvm: usb: assertion failure in usb_ep_get()EPSS 0.3%CVE-2026-18695HIGHImproper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of ServiceEPSS 0.3%CVE-2026-13055HIGHServer crash via aggregation pipeline expression with compound wildcard index specificationEPSS 0.3%CVE-2026-82068HIGHPersistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of ServiceEPSS 0.3%CVE-2023-37008MEDIUMOpen5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causEPSS 0.3%CVE-2026-82065HIGHInsufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted MetadataEPSS 0.3%CVE-2025-27066HIGHReachable Assertion in WLAN FirmwareEPSS 0.3%