Falhas do tipo CWE-617
559 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2023-53247MEDIUMbtrfs: set_page_extent_mapped after read_folio in btrfs_cont_expandEPSS 0.1%CVE-2023-53323MEDIUMext2/dax: Fix ext2_setsize when len is page alignedEPSS 0.1%CVE-2026-10674MEDIUMDoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabledEPSS 0.1%CVE-2026-63388HIGHLibevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX acceptEPSS 0.1%CVE-2026-96422MEDIUMReachable Assertion in WiresharkEPSS 0.1%CVE-2025-30034MEDIUMA vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not properly validate input EPSS 0.1%CVE-2026-120749MEDIUMDbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored busEPSS 0.1%CVE-2025-47370MEDIUMReachable Assertion in BT ControllerEPSS 0.1%CVE-2026-102916MEDIUMReachable assertion in illumos bhyve REP string instruction emulation allows guest to panic hostEPSS 0.1%CVE-2024-20139MEDIUMIn Bluetooth firmware, there is a possible firmware asssert due to improper handling of exceptional conditions. This could lead to local denEPSS 0.1%CVE-2022-25675MEDIUMDenial of service due to reachable assertion in modem while processing filter rule from application client in Snapdragon Compute, SnapdragonEPSS 0.1%CVE-2025-47384MEDIUMReachable Assertion in FWEPSS 0.1%CVE-2025-47371MEDIUMReachable Assertion in ModemEPSS 0.1%CVE-2026-31911MEDIUMabort() in libpcap before 1.10.7 on an invalid BPF opcodeEPSS 0.1%CVE-2026-19740MEDIUMBluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedureEPSS 0.1%CVE-2026-19739MEDIUMBluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection UpdateEPSS 0.1%CVE-2024-20152MEDIUMIn wlan STA driver, there is a possible reachable assertion due to improper exception handling. This could lead to local denial of service iEPSS 0.1%CVE-2026-17427MEDIUMThis Power System update is being released to addressEPSS —CVE-2026-124465HIGHTrendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer PanicEPSS —