Falhas do tipo CWE-617
556 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2022-23586MEDIUMMultiple `CHECK`-fails in `function.cc` in TensorflowEPSS 0.8%CVE-2021-1440MEDIUMCisco IOS XR Software BGP Resource Public Key Infrastructure Denial of Service VulnerabilityEPSS 0.8%CVE-2025-5501MEDIUMOpen5GS NGAP PathSwitchRequest Message ngap-handler.c ngap_handle_path_switch_request_transfer assertionEPSS 0.8%CVE-2022-23582MEDIUM`CHECK`-failures in `TensorByteSize` in TensorflowEPSS 0.8%CVE-2025-29339HIGHAn issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure vulnerability in PFCP session parameter validation. When pEPSS 0.8%CVE-2025-15531MEDIUMOpen5GS context.c sgwc_bearer_add assertionEPSS 0.8%CVE-2025-15530MEDIUMOpen5GS s11-handler.c assertionEPSS 0.8%CVE-2023-37024HIGHA reachable assertion in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fEPSS 0.8%CVE-2024-20094HIGHIn Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional exeEPSS 0.8%CVE-2025-15684MEDIUMOpen5GS CER init.c diam_log_func assertionEPSS 0.7%CVE-2024-53429HIGHOpen62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash.EPSS 0.7%CVE-2023-34868HIGHJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start at jerry-core/parseEPSS 0.7%CVE-2024-31744HIGHIn Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attEPSS 0.7%CVE-2023-44386MEDIUMIncorrect request error handling triggers server crash in VaporEPSS 0.7%CVE-2023-34867HIGHJerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_property_hashmap_create at jerry-core/ecma/baseEPSS 0.7%CVE-2026-1738MEDIUMOpen5GS SGWC context.c sgwc_tunnel_add assertionEPSS 0.7%CVE-2020-15197MEDIUMDenial of Service in TensorflowEPSS 0.7%CVE-2026-90785MEDIUMDvidelabs flatcc Struct Analysis semantics.c analyze_struct assertionEPSS 0.7%CVE-2026-90786MEDIUMDvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertionEPSS 0.7%CVE-2023-23759HIGHThere is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requiresEPSS 0.7%