Falhas do tipo CWE-617
459 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2025-5520MEDIUMOpen5GS AMF/MME emm_state_authentication assertionEPSS 0.9%CVE-2025-46354HIGHA denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloomberg Comdb2 8.1. A specEPSS 0.8%CVE-2022-23579MEDIUM`CHECK`-failures during Grappler's `SafeToRemoveIdentity` in TensorflowEPSS 0.8%CVE-2022-23586MEDIUMMultiple `CHECK`-fails in `function.cc` in TensorflowEPSS 0.8%CVE-2021-1440MEDIUMCisco IOS XR Software BGP Resource Public Key Infrastructure Denial of Service VulnerabilityEPSS 0.8%CVE-2025-20666MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.8%CVE-2025-15531MEDIUMOpen5GS context.c sgwc_bearer_add assertionEPSS 0.8%CVE-2025-15530MEDIUMOpen5GS s11-handler.c assertionEPSS 0.8%CVE-2022-23582MEDIUM`CHECK`-failures in `TensorByteSize` in TensorflowEPSS 0.8%CVE-2025-8804MEDIUMOpen5GS AMF ngap_build_downlink_nas_transport assertionEPSS 0.8%CVE-2023-37021HIGHOpen5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.8%CVE-2023-37019HIGHOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An EPSS 0.8%CVE-2023-37017HIGHOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.8%CVE-2024-24430HIGHA reachable assertion in the mme_ue_find_by_imsi function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafEPSS 0.8%CVE-2023-37016HIGHOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.8%CVE-2023-37023HIGHOpen5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. A packet missing its `MME_UE_S1AP_EPSS 0.8%CVE-2024-34235HIGHOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An EPSS 0.8%CVE-2023-37020HIGHOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.8%CVE-2023-37018HIGHOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An EPSS 0.8%CVE-2023-37015HIGHOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An EPSS 0.8%