Falhas do tipo CWE-617
556 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2022-20694MEDIUMCisco IOS XE Software Border Gateway Protocol Resource Public Key Infrastructure Denial of Service VulnerabilityEPSS 1.2%CVE-2022-48363HIGHIn MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain sEPSS 1.2%CVE-2022-23581MEDIUM`CHECK`-failures during Grappler's `IsSimplifiableReshape` in TensorflowEPSS 1.2%CVE-2021-20286—A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of service.EPSS 1.1%CVE-2023-5871MEDIUMLibnbd: malicious nbd server may crash libnbdEPSS 1.1%CVE-2021-32815MEDIUMDenial of service due to assertion failure in crwimage_int.cppEPSS 1.1%CVE-2019-5020MEDIUMAn exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can EPSS 1.1%CVE-2024-33601HIGHnscd: netgroup cache may terminate daemon on memory allocation failureEPSS 1.1%CVE-2023-39534HIGHMalformed GAP submessage triggers assertion failureEPSS 1.0%CVE-2023-39949HIGHImproper validation of sequence numbers leading to remotely reachable assertion failureEPSS 1.0%CVE-2022-24272MEDIUMMongoDB Server (mongod) may crash in response to unexpected requestsEPSS 1.0%CVE-2026-45815HIGHApache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handlerEPSS 1.0%CVE-2020-15194MEDIUMDenial of Service in TensorflowEPSS 1.0%CVE-2025-40777HIGHA possible assertion failure when 'stale-answer-client-timeout' is set to '0'EPSS 1.0%CVE-2019-14851—A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertEPSS 1.0%CVE-2021-3454MEDIUMTruncated L2CAP K-frame causes assertion failureEPSS 1.0%CVE-2026-56388CRITICALApache bRPC: Out-of-Bounds Write in Redis Command ParserEPSS 1.0%CVE-2021-3431MEDIUMBT: Assertion failure on repeated LL_FEATURE_REQEPSS 0.9%CVE-2021-3430MEDIUMBT: Assertion failure on repeated LL_CONNECTION_PARAM_REQEPSS 0.9%CVE-2026-41523HIGHvLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code ExecutionEPSS 0.9%