CWE-617— Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.— MITRE CWE catalog

965 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-617page 5 of 20

CVE-2023-32820HIGHCVSS 7.5EG 7.5
2023-10-02
In wlan firmware, there is a possible firmware assertion due to improper input handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:…
CVE-2023-4236HIGHCVSS 7.5EG 7.5
2023-09-20
A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query loa…
CVE-2023-21653HIGHCVSS 7.5EG 7.5
2023-09-05
Transient DOS in Modem while processing RRC reconfiguration message.
CVE-2023-21646HIGHCVSS 7.5EG 7.5
2023-09-05
Transient DOS in Modem while processing invalid System Information Block 1.
CVE-2023-38976HIGHCVSS 7.5EG 7.5
2023-08-21
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.
CVE-2023-39949HIGHCVSS 7.5EG 7.5
2023-08-11
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure…
CVE-2023-39534HIGHCVSS 7.5EG 7.5
2023-08-11
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Ver…
CVE-2023-34868HIGHCVSS 7.5EG 7.5
2023-06-14
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start at jerry-core/parser/js/js-parser-statm.c.
CVE-2023-34867HIGHCVSS 7.5EG 7.5
2023-06-14
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_property_hashmap_create at jerry-core/ecma/base/ecma-property-hashmap.c.
CVE-2023-1428HIGHCVSS 7.5EG 7.5
2023-06-09
There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x …
CVE-2022-40538HIGHCVSS 7.5EG 7.5
2023-06-06
Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network.
CVE-2022-33251HIGHCVSS 7.5EG 7.5
2023-06-06
Transient DOS due to reachable assertion in Modem because of invalid network configuration.
CVE-2022-22060HIGHCVSS 7.5EG 7.5
2023-06-06
Assertion occurs while processing Reconfiguration message due to improper validation
CVE-2023-34411HIGHCVSS 7.5EG 7.5
2023-06-05
The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
CVE-2023-23759HIGHCVSS 7.5EG 7.5
2023-05-18
There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second…
CVE-2023-2156HIGHCVSS 7.5EG 7.5
2023-05-09
A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an …
CVE-2022-40504HIGHCVSS 7.5EG 7.5
2023-05-02
Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.
CVE-2022-40508HIGHCVSS 7.5EG 7.5
2023-05-02
Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported.
CVE-2022-34144HIGHCVSS 7.5EG 7.5
2023-05-02
Transient DOS due to reachable assertion in Modem during OSI decode scheduling.
CVE-2022-36440HIGHCVSS 7.5EG 7.5
2023-04-03
A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in DoS.
CVE-2023-27789HIGHCVSS 7.5EG 7.5
2023-03-16
An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the cidr2cidr function at the cidr.c:178 endpoint.
CVE-2023-27788HIGHCVSS 7.5EG 7.5
2023-03-16
An issue found in TCPrewrite v.4.4.3 allows a remote attacker to cause a denial of service via the ports2PORT function at the portmap.c:69 endpoint.
CVE-2023-27783HIGHCVSS 7.5EG 7.5
2023-03-16
An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at plugins/dlt_plugins.c.
CVE-2022-40527HIGHCVSS 7.5EG 7.5
2023-03-10
Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.
CVE-2022-33272HIGHCVSS 7.5EG 7.5
2023-03-10
Transient DOS in modem due to reachable assertion.
CVE-2022-33254HIGHCVSS 7.5EG 7.5
2023-03-10
Transient DOS due to reachable assertion in Modem while processing SIB1 Message.
CVE-2022-33250HIGHCVSS 7.5EG 7.5
2023-03-10
Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover.
CVE-2022-33244HIGHCVSS 7.5EG 7.5
2023-03-10
Transient DOS due to reachable assertion in modem during MIB reception and SIB timeout
CVE-2022-48363HIGHCVSS 7.5EG 7.5
2023-02-26
In MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain situations involving truncated files. Eventually there is an assertion failure in libmpdclient becau…
CVE-2022-3924HIGHCVSS 7.5EG 7.5
2023-01-26
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion…
CVE-2022-3488HIGHCVSS 7.5EG 7.5
2023-01-26
Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure. 'Broken' in this context is anything that wo…
CVE-2020-36562HIGHCVSS 7.5EG 7.5
2022-12-28
Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector.
CVE-2022-47516HIGHCVSS 7.5EG 7.5
2022-12-18
An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.…
CVE-2022-25702HIGHCVSS 7.5EG 7.5
2022-12-13
Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVE-2022-25692HIGHCVSS 7.5EG 7.5
2022-12-13
Denial of service in Modem due to reachable assertion while processing the common config procedure in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVE-2022-25691HIGHCVSS 7.5EG 7.5
2022-12-13
Denial of service in Modem due to reachable assertion while processing SIB1 with invalid SCS and bandwidth settings in Snapdragon Mobile
CVE-2022-25689HIGHCVSS 7.5EG 7.5
2022-12-13
Denial of service in Modem due to reachable assertion in Snapdragon Mobile
CVE-2022-25673HIGHCVSS 7.5EG 7.5
2022-12-13
Denial of service in MODEM due to reachable assertion while processing configuration from network in Snapdragon Mobile
CVE-2022-25672HIGHCVSS 7.5EG 7.5
2022-12-13
Denial of service in MODEM due to reachable assertion while processing SIB1 with invalid Bandwidth in Snapdragon Mobile
CVE-2022-25671HIGHCVSS 7.5EG 7.5
2022-11-15
Denial of service in MODEM due to reachable assertion in Snapdragon Mobile
CVE-2022-26446HIGHCVSS 7.5EG 7.5
2022-11-08
In Modem 4G RRC, there is a possible system crash due to improper input validation. This could lead to remote denial of service, when concatenating improper SIB12 (CMAS message), with no additional execution privileges needed. User interac…
CVE-2022-3029HIGHCVSS 7.5EG 7.5
2022-09-13
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error and causes Routinator to exit. Worst ca…
CVE-2022-34967HIGHCVSS 7.5EG 7.5
2022-08-03
The assertion `stmt->Dbc->FirstStmt' failed in MonetDB Database Server v11.43.13.
CVE-2022-32082HIGHCVSS 7.5EG 7.5
2022-07-01
MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.
CVE-2022-33024HIGHCVSS 7.5EG 7.5
2022-06-23
There is an Assertion `int decode_preR13_entities(BITCODE_RL, BITCODE_RL, unsigned int, BITCODE_RL, BITCODE_RL, Bit_Chain *, Dwg_Data *' failed at dwg2dxf: decode.c:5801 in libredwg v0.12.4.4608.
CVE-2021-35073HIGHCVSS 7.5EG 7.5
2022-06-14
Possible assertion due to improper validation of rank restriction field in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVE-2021-30340HIGHCVSS 7.5EG 7.5
2022-06-14
Reachable assertion due to improper validation of coreset in PDCCH configuration in SA mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVE-2022-29228HIGHCVSS 7.5EG 7.5
2022-06-09
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in newer versions and corrupts …
CVE-2022-1183HIGHCVSS 7.5EG 7.5
2022-05-19
On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS i…
CVE-2021-27500HIGHCVSS 7.5EG 7.5
2022-05-12
A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.

Map vulnerabilities like CWE-617 to your infrastructure

EchelonGraph correlates every CVE — across CWE-617 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →