Falhas do tipo CWE-617
557 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2025-66443HIGHPexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation EPSS 0.3%CVE-2024-23850MEDIUMIn btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvoluEPSS 0.3%CVE-2026-121389LOWFreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement LoggingEPSS 0.3%CVE-2026-104434HIGHZebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPCEPSS 0.3%CVE-2026-27015MEDIUMFreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS)EPSS 0.3%CVE-2026-62289MEDIUMlibheif: Integer underflow in Fraction constructor via double clap transform applicationEPSS 0.3%CVE-2025-52964HIGHJunos OS and Junos OS Evolved: Receipt of a specific BGP UPDATE causes an rpd crash on devices with BGP multipath configuredEPSS 0.3%CVE-2026-24826CRITICALOut-of-bounds write in turso3dEPSS 0.3%CVE-2026-10651HIGHOut-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)EPSS 0.3%CVE-2026-34069MEDIUMnimiq-consensus panics via RequestMacroChain micro-block locatorEPSS 0.3%CVE-2023-31921MEDIUMJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_big_uint_div_mod at jerry-core/ecma/operations/EPSS 0.3%CVE-2025-20762MEDIUMIn Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connectEPSS 0.3%CVE-2025-20760MEDIUMIn Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote denial of service, if EPSS 0.3%CVE-2025-56361MEDIUMA reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster'sEPSS 0.3%CVE-2026-46543MEDIUMnimiq-blockchain: Genesis batch set requestEPSS 0.3%CVE-2026-20450MEDIUMIn Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connectEPSS 0.3%CVE-2026-39453HIGHRed Lion Controls N-Tron 700 Series Reachable AssertionEPSS 0.3%CVE-2026-102063HIGHJunos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR link protection is usedEPSS 0.3%CVE-2024-8354MEDIUMQemu-kvm: usb: assertion failure in usb_ep_get()EPSS 0.3%CVE-2026-20504MEDIUMIn Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedEPSS 0.3%