Skip to content
OpenAdvisories

Weakness (CWE)

CWE-617: Reachable Assertion

Base Draft

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

How to prevent it (4 mitigations)

  1. Implementation

    If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.

  2. Implementation

    Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.

  3. Implementation

    Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)

  4. Implementation

    Perform input validation on user data.

Source: MITRE CWE-617

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-66754 Public exploit

    Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

    Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decod…

    tomaka rouille rust-rouille Debian
  • Medium 6.9
    CVE-2026-29115 Public exploit

    A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially …

    Dahua IPC/SD