Falhas do tipo CWE-617
460 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2021-20286—A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of service.EPSS 1.1%CVE-2022-26446HIGHIn Modem 4G RRC, there is a possible system crash due to improper input validation. This could lead to remote denial of service, when concatEPSS 1.1%CVE-2021-32815MEDIUMDenial of service due to assertion failure in crwimage_int.cppEPSS 1.1%CVE-2019-5020MEDIUMAn exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can EPSS 1.1%CVE-2024-33601HIGHnscd: netgroup cache may terminate daemon on memory allocation failureEPSS 1.1%CVE-2023-39949HIGHImproper validation of sequence numbers leading to remotely reachable assertion failureEPSS 1.0%CVE-2023-39534HIGHMalformed GAP submessage triggers assertion failureEPSS 1.0%CVE-2020-15194MEDIUMDenial of Service in TensorflowEPSS 1.0%CVE-2019-14851—A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertEPSS 1.0%CVE-2021-3454MEDIUMTruncated L2CAP K-frame causes assertion failureEPSS 1.0%CVE-2022-24272MEDIUMMongoDB Server (mongod) may crash in response to unexpected requestsEPSS 0.9%CVE-2023-5871MEDIUMLibnbd: malicious nbd server may crash libnbdEPSS 0.9%CVE-2025-40777HIGHA possible assertion failure when 'stale-answer-client-timeout' is set to '0'EPSS 0.9%CVE-2026-41523HIGHvLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code ExecutionEPSS 0.9%CVE-2021-3431MEDIUMBT: Assertion failure on repeated LL_FEATURE_REQEPSS 0.9%CVE-2021-3430MEDIUMBT: Assertion failure on repeated LL_CONNECTION_PARAM_REQEPSS 0.9%CVE-2022-23583MEDIUM`CHECK`-failures in binary ops in TensorflowEPSS 0.9%CVE-2023-40462HIGHImproper input leads to DoSEPSS 0.9%CVE-2022-23588MEDIUM`CHECK`-fails due to attempting to build a reference tensor in TensorflowEPSS 0.9%CVE-2022-31100MEDIUMReachable Assertion in rulexEPSS 0.9%