Weakness (CWE)
CWE-617: Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
How to prevent it (4 mitigations)
-
Implementation
If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
-
Implementation
Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.
-
Implementation
Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)
-
Implementation
Perform input validation on user data.
Source: MITRE CWE-617
315 results · Clear filters · Feed
-
Medium 6.5
Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message.
-
Medium 6.5
Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled
A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cl…
-
Medium 6.5
Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configured
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured.
-
Medium 6.5
Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enabled
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message.
-
Medium 6.5
Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS automatic site-ID collision resolution is used
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of service via a VPLS signaling update when automatic site-ID negotiation is enabled.
-
Medium 6.5
Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured
A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message.
-
Medium 6.5
Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bidirectional LSP is enabled
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.
-
Medium 6.5
Junos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR link protection is used
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in…
-
Medium 6.5
Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregatio…
-
Medium 6.5
Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregatio…
-
Medium 6.5
FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client…
-
Medium 6.5
FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context and reaches a terminating WINPR_ASSERT. A malicious RDP server…
-
Medium 6.5
FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scard_copy_strings. A malicious RDP server can send an SCa…
-
Medium 6.5
Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance
Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object …
-
Medium 6.5
gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header
gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring …
-
Medium 6.5
Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure
The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so that it can later be reused for the host notification when the update instant is reach…
-
Medium 6.5
Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update
The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notifi…
-
Medium 6.8
Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instru…
-
Medium 5.9
Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request
Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN a…
-
Medium 6.5
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm…
-
Medium 6.5
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiv…
-
Medium 6.6
An empty <img> attribute value in styled text triggers a parser error that halts the device.
In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails an…
-
Medium 5.3
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 6.5
Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC
ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying invalid Jubjub points. Aut…
-
Medium 5.3
Zebra before 11.0.0 Denial of Service via getblock Verbosity 2
The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect(), aborting the process. Remote unauthen…
-
Medium 5.5
Reachable Assertion in Wireshark
Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.5
A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can…
-
Medium 5.9
Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash
A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root p…
-
Medium 4.3
libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling…
-
Medium 5.3
Assertion failure in the DNS stub resolver with a long search domain
Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which abor…
-
Medium 4.3
Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertion
A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the file src/smf/n4-handler.c of the component PFCP Session Report Request Handler. The manipulation leads to reachable asser…
-
Medium 5.3
Security Advisory 0172
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpec…
-
Medium 6.5
OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa…
-
Medium 6.5
FreeRDP before 3.31.0 Denial of Service via URBDRC
FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP server can send a control-transfer request with Outpu…
-
Medium 6.5
FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc
FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write pas…
-
Medium 6.5
Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS
net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable + sys_rand32_get() % (max_reachable - min_reachable), where min_reachable = base/2 and max_reachable = 3*base/2 …
-
Medium 5.3
Dvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertion
A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the file src/compiler/semantics.c of the component Duplicate Symbol Handler. This manipulation causes reachable assertion. The attack can be initi…
-
Medium 5.3
Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion
A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/compiler/semantics.c of the component Struct Analysis. The manipulation results in reachable assertion. It is possible to launch the attack rem…
-
Medium 6.5
Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service
A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repe…
-
Medium 6.5
Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata
A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits …