Weakness (CWE)
CWE-617: Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
How to prevent it (4 mitigations)
-
Implementation
If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
-
Implementation
Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.
-
Implementation
Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)
-
Implementation
Perform input validation on user data.
Source: MITRE CWE-617
579 results · Feed
-
Unscored —
A flaw was found in privoxy before 3.0.32. An assertion failure could be triggered with a crafted CGI request leading t…
-
High 7.5
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences …
-
High 7.5
Incorrect implementation in streebog
An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.
-
Medium 4.8
The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irre…
-
Unscored —
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB reque…
-
Medium 5.3
Denial of Service in Tensorflow
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of its arguments. Although `reverse_index_map_t` and `grad_values_t` are accessed in a similar pattern, o…
-
Medium 6.3
Denial of Service in Tensorflow
In Tensorflow before version 2.3.1, the `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has rank 2. This tensor must be a matrix be…
-
High 7.5
An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b…
-
Medium 5.0
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. Th…
-
Medium 6.5
An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially cra…
-
High 7.5
Junos OS: A flowspec BGP update with a specific term-order causes routing protocol daemon (rpd) process to crash with a core.
When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon (rpd) process to crash wi…
-
Unscored —CVE-2018-12543 EPSS 36%
In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting …
-
Medium 5.3
An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connectio…
-
High 7.5
The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to ca…
-
Medium 5.5
Reachable Assertion in OpenCV.
In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.
-
Unscored —
The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM gue…
-
Unscored —
OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over…
-
Unscored —
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large contro…
-
High 7.5
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service …
KEV Oct 8, 2026