Skip to content
OpenAdvisories

Weakness (CWE)

CWE-617: Reachable Assertion

Base Draft

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

How to prevent it (4 mitigations)

  1. Implementation

    If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.

  2. Implementation

    Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.

  3. Implementation

    Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)

  4. Implementation

    Perform input validation on user data.

Source: MITRE CWE-617

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.5
    CVE-2026-52856 Public exploit

    Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

    Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

    pterodactyl wings github.com/pterodactyl/wings Go
  • Medium 5.9
    CVE-2026-66754 Public exploit

    Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

    Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decod…

    tomaka rouille rust-rouille Debian
  • High 8.7
    CVE-2026-29116 Public exploit

    A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a speciall…

    Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC
  • Medium 6.9
    CVE-2026-29115 Public exploit

    A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially …

    Dahua IPC/SD
  • High 7.1
    CVE-2025-4321 Public exploit

    DoS in RS9116W-WiSeConnect L2CAP protocol due to reception of malformed packets

    In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the device to normal operation

    silabs.com RS9116W
  • High 8.7
    CVE-2025-41067 Public exploit

    Reachable Assertion vulnerability in Open5GS

    Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that ends up crashing the NRF process and renders th…

    NewPlane open5GS
  • Low 2.9
    CVE-2025-50422 Public exploit

    Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_…

    cairographics Cairo cairo cairo Debian Ubuntu
  • Unscored —
    CVE-2017-7478 Public exploit EPSS 14%

    OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large contro…

    OpenVPN Technologies OpenVPN openvpn openvpn Debian Alpine
  • High 7.5
    CVE-2015-5477 Exploited Public exploit EPSS 100%

    named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service …

    bind9 bind9 Debian Ubuntu
    KEV Oct 8, 2026