Falhas do tipo CWE-617
556 resultadosAsserção acessível ao atacante
É quando o código contém uma asserção (assertion) que pode ser disparada por um atacante, causando travamento ou parada da aplicação. Diferente de asserções usadas apenas em desenvolvimento, essas chegam à produção e podem ser exploradas para negar serviço.
Exemplo
Um servidor web valida entrada do usuário com assert(tamanho_entrada < 1000). Um atacante envia payload grande, a asserção falha e o processo morre, deixando o serviço indisponível para outros usuários.
Como mitigar
Remova ou desative asserções em código de produção; use exceções tratáveis em vez de assertions para validações que dependem de entrada do usuário. Compile com flags que desabilitam assertions (-da em Java) antes de deployar.
CVE-2026-92151HIGHF´: SpacePacketDeframer Small Packet Assertion DoSEPSS 0.5%CVE-2026-35058MEDIUMImproper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows EPSS 0.5%CVE-2024-50613MEDIUMlibsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.EPSS 0.5%CVE-2026-92156MEDIUMF´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridgeEPSS 0.5%CVE-2026-78186MEDIUMOpen5GS HSS hss-cx-path.c assertionEPSS 0.5%CVE-2026-92416MEDIUMOpen5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertionEPSS 0.5%CVE-2022-35991MEDIUM`CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in TensorFlowEPSS 0.5%CVE-2022-35935MEDIUM`CHECK` failure in `SobolSample` via missing validation in TensorFlowEPSS 0.5%CVE-2024-45795HIGHSuricata detect/datasets: reachable assertion with unimplemented rule optionEPSS 0.5%CVE-2026-12617HIGHRecord ordering based unexpected exit with CNAME or DNAMEEPSS 0.5%CVE-2026-13204HIGHUnexpected exit in certain situations with NSEC and NSEC3 both presentEPSS 0.5%CVE-2026-108105HIGHOpen5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context RequestEPSS 0.5%CVE-2026-82064HIGHUnauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set MembersEPSS 0.5%CVE-2023-33044HIGHReachable Assertion in Data ModemEPSS 0.5%CVE-2023-33043HIGHReachable Assertion in ModemEPSS 0.5%CVE-2023-37011MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.5%CVE-2023-37010MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.5%CVE-2023-37009MEDIUMOpen5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An aEPSS 0.5%CVE-2024-24428HIGHA reachable assertion in the oai_nas_5gmm_decode function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafEPSS 0.5%CVE-2026-29115MEDIUMA vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, triggEPSS 0.5%