Falhas do tipo CWE-617

557 resultados

Asserção acessível ao atacante

É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.

Exemplo

Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.

Como mitigar

Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.

CVE-2023-33096HIGHReachable Assertion in Multi-Mode Call ProcessorEPSS 0.3%CVE-2023-33095HIGHReachable Assertion in Multi-Mode Call ProcessorEPSS 0.3%CVE-2023-43529HIGHReachable Assertion in Data ModemEPSS 0.3%CVE-2026-9748HIGH$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries inputEPSS 0.3%CVE-2026-109350HIGHGitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base DistanceEPSS 0.3%CVE-2023-38470MEDIUMReachable assertion in avahi_escape_labelEPSS 0.3%CVE-2023-38469MEDIUMReachable assertion in avahi_dns_packet_append_recordEPSS 0.3%CVE-2023-38473MEDIUMReachable assertion in avahi_alternative_host_nameEPSS 0.3%CVE-2023-38472MEDIUMReachable assertion in avahi_rdata_parseEPSS 0.3%CVE-2026-34067LOWnimiq-transaction vulnerable to panic via `HistoryTreeProof` length mismatchEPSS 0.3%CVE-2026-121396MEDIUMFreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertionEPSS 0.3%CVE-2026-8674MEDIUMAssertion failure in the DNS stub resolver with a long search domainEPSS 0.3%CVE-2025-49088MEDIUMPexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Join, has Improper InputEPSS 0.3%CVE-2026-85534MEDIUMLibsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body readEPSS 0.3%CVE-2026-75894HIGHReachable assertion at ranap_handle_co_dt()EPSS 0.3%CVE-2026-103108HIGHPexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a reEPSS 0.3%CVE-2026-103099HIGHPexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a sEPSS 0.3%CVE-2026-103104HIGHPexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a reEPSS 0.3%CVE-2025-66443HIGHPexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation EPSS 0.3%CVE-2025-32096HIGHPexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort,EPSS 0.3%