Falhas do tipo CWE-617
460 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2023-33044HIGHReachable Assertion in Data ModemEPSS 0.5%CVE-2024-50613MEDIUMlibsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.EPSS 0.5%CVE-2026-12617HIGHRecord ordering based unexpected exit with CNAME or DNAMEEPSS 0.5%CVE-2024-42644HIGHFlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS EPSS 0.5%CVE-2024-42645HIGHAn issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leading to a Denial of ServEPSS 0.5%CVE-2023-37011MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.5%CVE-2023-37010MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.5%CVE-2023-37009MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.5%CVE-2026-92971HIGHInternLM LMDeploy through 0.17.0 Assertion Denial of ServiceEPSS 0.5%CVE-2024-24428HIGHA reachable assertion in the oai_nas_5gmm_decode function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafEPSS 0.5%CVE-2026-44435HIGHQuicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KBEPSS 0.5%CVE-2022-36004MEDIUM`CHECK` fail in `tf.random.gamma` in TensorFlowEPSS 0.5%CVE-2022-35997MEDIUM`CHECK` fail in `tf.sparse.cross` in TensorFlowEPSS 0.5%CVE-2022-35988MEDIUM`CHECK` fail in `tf.linalg.matrix_rank` in TensorFlowEPSS 0.5%CVE-2022-35998MEDIUM`CHECK` fail in `EmptyTensorList` in TensorFlowEPSS 0.5%CVE-2026-80274HIGHValidating resolver can abort while caching a mismatched NOQNAME proofEPSS 0.5%CVE-2026-76163HIGHnamed aborts on a TKEY query when the user configuration has no global options statementEPSS 0.5%CVE-2022-35985MEDIUM`CHECK` fail in `LRNGrad` in TensorFlowEPSS 0.5%CVE-2022-35934MEDIUM`CHECK` failure in tf.reshape in TensorflowEPSS 0.5%CVE-2022-36001MEDIUM`CHECK` fail in `DrawBoundingBoxes` in TensorFlowEPSS 0.5%