Falhas do tipo CWE-617
555 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2026-102034HIGHJunos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabledEPSS 0.3%CVE-2026-102042HIGHJunos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabledEPSS 0.3%CVE-2026-102035HIGHJunos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabledEPSS 0.3%CVE-2026-101996HIGHJunos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configuredEPSS 0.3%CVE-2026-102011HIGHJunos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabledEPSS 0.3%CVE-2026-102041HIGHJunos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabledEPSS 0.3%CVE-2026-101984HIGHJunos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configuredEPSS 0.3%CVE-2023-37005MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37004MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37007MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37006MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2026-41584CRITICALZEBRA: rk Identity Point Panic in Transaction VerificationEPSS 0.3%CVE-2023-37003MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37002MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2023-37012MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.3%CVE-2025-20757MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecEPSS 0.3%CVE-2026-33977MEDIUMFreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)EPSS 0.3%CVE-2026-103100HIGHPexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigEPSS 0.3%CVE-2025-20752MEDIUMIn Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedEPSS 0.3%CVE-2026-109240LOWFreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transferEPSS 0.3%