Falhas do tipo CWE-617
557 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2021-43849MEDIUMDoS vulnerabilityEPSS 0.3%CVE-2022-2719MEDIUMIn ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NUEPSS 0.3%CVE-2026-107838HIGHRIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertionEPSS 0.3%CVE-2026-92160MEDIUMF´: SendPartial Integer Overflow Leading to Assertion DoSEPSS 0.3%CVE-2023-31918MEDIUMJerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the parser_parse_function_arguments at jerry-core/parserEPSS 0.3%CVE-2023-31916MEDIUMJerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the jmem_heap_finalize at jerry-core/jmem/jmem-heap.c.EPSS 0.3%CVE-2023-31919MEDIUMJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the jcontext_raise_exception at jerry-core/jcontext/jconEPSS 0.3%CVE-2023-31913MEDIUMJerryscript 3.0 *commit 1a2c047) was discovered to contain an Assertion Failure via the component parser_parse_class at jerry-core/parser/jsEPSS 0.3%CVE-2025-56568HIGHAssertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF (Session Management Function) component of OpeEPSS 0.3%CVE-2026-30867MEDIUMCocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet ParsingEPSS 0.3%CVE-2025-27066HIGHReachable Assertion in WLAN FirmwareEPSS 0.3%CVE-2026-121409HIGHFreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing TokenEPSS 0.3%CVE-2023-38471MEDIUMReachable assertion in dbus_set_host_nameEPSS 0.3%CVE-2023-31920MEDIUMJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm_loop at jerry-core/vm/vm.c.EPSS 0.3%CVE-2024-25445HIGHImproper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure.EPSS 0.3%CVE-2026-15893MEDIUMZephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoSEPSS 0.3%CVE-2026-109946HIGHFreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region WidthEPSS 0.3%CVE-2026-109678HIGHFreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusAEPSS 0.3%CVE-2024-7139MEDIUMDenial of Service in Silicon Labs RS9116 Bluetooth SDKEPSS 0.3%CVE-2023-33095HIGHReachable Assertion in Multi-Mode Call ProcessorEPSS 0.3%