Falhas do tipo CWE-617

460 resultados

Asserção acessível ao atacante

É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.

Exemplo

Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.

Como mitigar

Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.

CVE-2025-56362HIGHA reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster'sEPSS 0.6%CVE-2025-56361HIGHA reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster'sEPSS 0.6%CVE-2026-3119MEDIUMAuthenticated query containing a TKEY record may cause named to terminate unexpectedlyEPSS 0.6%CVE-2025-46705HIGHA denial of service vulnerability exists in the g_assert_not_reached functionality of Entr&#39;ouvert Lasso 2.5.1 and 2.8.2. A specially craEPSS 0.6%CVE-2025-69534HIGHPython-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandlEPSS 0.6%CVE-2026-34219HIGHlibp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant OverflowEPSS 0.6%CVE-2024-24429HIGHA reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a EPSS 0.6%CVE-2024-39949HIGHA vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, cEPSS 0.6%CVE-2026-14957HIGHFIPS mode assertion failure via malicious CERT payloadEPSS 0.6%CVE-2025-36512HIGHA denial of service vulnerability exists in the Bloomberg Comdb2 8.1 database when handling a distributed transaction heartbeat. A speciallyEPSS 0.5%CVE-2026-35058MEDIUMImproper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows EPSS 0.5%CVE-2026-2523MEDIUMOpen5GS SMF gn-handler.c smf_gn_handle_create_pdp_context_request assertionEPSS 0.5%CVE-2022-35935MEDIUM`CHECK` failure in `SobolSample` via missing validation in TensorFlowEPSS 0.5%CVE-2024-45795HIGHSuricata detect/datasets: reachable assertion with unimplemented rule optionEPSS 0.5%CVE-2022-35991MEDIUM`CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in TensorFlowEPSS 0.5%CVE-2023-37013HIGHOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a sufficiently large ASN.1 packet over the S1AP interEPSS 0.5%CVE-2026-13204HIGHUnexpected exit in certain situations with NSEC and NSEC3 both presentEPSS 0.5%CVE-2026-1737MEDIUMOpen5GS CreateBearerRequest s5c-handler.c sgwc_s5c_handle_create_bearer_request assertionEPSS 0.5%CVE-2023-33043HIGHReachable Assertion in ModemEPSS 0.5%CVE-2023-44175MEDIUMJunos OS and Junos OS Evolved: Receipt of a specific genuine PIM packet causes RPD crashEPSS 0.5%