Weakness (CWE)
CWE-617: Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
How to prevent it (4 mitigations)
-
Implementation
If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
-
Implementation
Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.
-
Implementation
Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)
-
Implementation
Perform input validation on user data.
Source: MITRE CWE-617
578 results · Feed
-
High 7.5
Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to tri…
-
Medium 5.9
Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Joi…
-
High 8.7
wb2osz/direwolf <= 1.8.1 Reachable Assertion DoS
wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 3658a87, contain a reachable assertion vulnerability in the APRS MIC-E decoder function aprs_mic_e() located in src/decode_aprs.c. When processing a specially crafted AX.25 frame …
-
Low 3.7
Open5GS QER/FAR/URR/PDR context.c ogs_pfcp_qer_find_or_add assertion
A vulnerability has been found in Open5GS up to 2.7.6. Affected is the function ogs_pfcp_pdr_find_or_add/ogs_pfcp_far_find_or_add/ogs_pfcp_urr_find_or_add/ogs_pfcp_qer_find_or_add in the library lib/pfcp/context.c of the component QER/FAR/URR/PDR. The manipul…
-
High 7.5
An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), t…
-
Medium 5.3
Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor
An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY.
-
Medium 6.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service…
-
Medium 6.5
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, …
-
Medium 6.5
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 5.3
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 6.5
MongoDB may be susceptible to Invariant Failure due to batched delete
MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSi…
-
Medium 6.5
Free5GC is vulnerable to DoS through its Npcf_BDTPolicyControl POST API
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl API.
-
High 7.1CVE-2025-4321 Public exploit
DoS in RS9116W-WiSeConnect L2CAP protocol due to reception of malformed packets
In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the device to normal operation
-
High 7.5
Potential denial of service in golang.org/x/crypto/ssh/agent
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
-
High 7.5
A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert Lasso 2.5.1 and 2…
-
Medium 6.5
Reachable Assertion in BT Controller
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.
-
High 8.7
Reachable Assertion vulnerability in Open5GS
Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. This is achieved by sending the creation of an NF with an invalid type via SBI and then requesting its data. The NRF e…
-
High 8.7CVE-2025-41067 Public exploit
Reachable Assertion vulnerability in Open5GS
Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that ends up crashing the NRF process and renders th…
-
High 7.5
quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame
quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a proce…
-
Medium 5.3
In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.
-
Medium 5.5
ext2/dax: Fix ext2_setsize when len is page aligned
In the Linux kernel, the following vulnerability has been resolved: ext2/dax: Fix ext2_setsize when len is page aligned PAGE_ALIGN(x) macro gives the next highest value which is multiple of pagesize. But if x is already page aligned then it simply returns x. …
-
Medium 5.5
media: vimc: Fix wrong function called when vimc_init() fails
In the Linux kernel, the following vulnerability has been resolved: media: vimc: Fix wrong function called when vimc_init() fails In vimc_init(), when platform_driver_register(&vimc_pdrv) fails, platform_driver_unregister(&vimc_pdrv) is wrongly called rather …
-
Medium 5.5
btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand
In the Linux kernel, the following vulnerability has been resolved: btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand While trying to get the subpage blocksize tests running, I hit the following panic on generic/476 assertion failed: PagePri…
-
Medium 5.3
Open5GS gmm-sm.c gmm_state_exception assertion
A security flaw has been discovered in Open5GS up to 2.7.5. The impacted element is the function gmm_state_exception of the file src/amf/gmm-sm.c. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has b…
-
Low 3.3
jqlang jq JSON jq_test.c run_jq_tests assertion
A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been pub…
-
Low 3.3
cmake cmForEachCommand.cxx ReplayItems assertion
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit…
-
Medium 6.2
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not pro…
-
Low 3.3
JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion
A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approac…
-
Medium 5.3
Open5GS AMF ngap_build_downlink_nas_transport assertion
A vulnerability was found in Open5GS up to 2.7.5. Affected by this vulnerability is the function ngap_build_downlink_nas_transport of the component AMF. The manipulation leads to reachable assertion. The attack can be launched remotely. The exploit has been d…
-
Low 3.3
Open5GS AMF Service nsmf-handler.c amf_nsmf_pdusession_handle_release_sm_context assertion
A vulnerability was found in Open5GS up to 2.7.5. It has been classified as problematic. Affected is the function amf_nsmf_pdusession_handle_release_sm_context of the file src/amf/nsmf-handler.c of the component AMF Service. The manipulation leads to reachabl…
-
High 7.5
Reachable Assertion in WLAN Firmware
Transient DOS while creating NDP instance.
-
High 7.5
Reachable Assertion in WLAN Firmware
Transient DOS while processing an ANQP message.
-
High 7.5
Reachable Assertion in Modem
Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.
-
Low 2.9CVE-2025-50422 Public exploit
Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_…
-
Low 3.7
In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authent…
-
High 7.5
An issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leadin…
-
High 7.5
FlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which…
-
High 7.5
A denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloombe…
-
High 7.5
A denial of service vulnerability exists in the Bloomberg Comdb2 8.1 database when handling a distributed transaction h…
-
High 7.5
A possible assertion failure when 'stale-answer-client-timeout' is set to '0'
If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain…