Falhas do tipo CWE-617
461 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2024-33255MEDIUMJerryscript commit cefd391 was discovered to contain an Assertion Failure via ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p) in ecma_free_strinEPSS 0.3%CVE-2026-48852LOWPuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.EPSS 0.3%CVE-2026-19519MEDIUMClaircore: claircore: denial of service via unchecked type assertion in rpm header parserEPSS 0.3%CVE-2026-33952MEDIUMFreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checksEPSS 0.3%CVE-2026-9749HIGHUsing MaxKey() may crash the serverEPSS 0.3%CVE-2026-9746HIGHServer crashes in case of the use of exchangeEPSS 0.3%CVE-2026-9747HIGHCrafted cross-shard merge aggregation crashes MongoDB ServerEPSS 0.3%CVE-2026-14586MEDIUMAssertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environmentsEPSS 0.3%CVE-2026-24826CRITICALOut-of-bounds write in turso3dEPSS 0.3%CVE-2026-41584CRITICALZEBRA: rk Identity Point Panic in Transaction VerificationEPSS 0.3%CVE-2023-37004MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37005MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2024-24432MEDIUMA reachable assertion in the ogs_kdf_hash_mme function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a craftedEPSS 0.3%CVE-2023-37012MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37006MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37003MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37007MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37002MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2026-53532HIGHOpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)EPSS 0.3%CVE-2025-52964HIGHJunos OS and Junos OS Evolved: Receipt of a specific BGP UPDATE causes an rpd crash on devices with BGP multipath configuredEPSS 0.3%