CWE-617 Reachable Assertion
Description
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-617 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-ph3r-5jfg-f84f | CVE-2026-105753 | MODERATE |
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core |
2026-10-06 | |
| GHSA-ph72-cqr5-qpp7 | CVE-2026-105754 | MODERATE |
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features |
2026-10-05 | |
| GHSA-q8gq-377p-jq3r | CVE-2026-41523 | HIGH |
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution |
2026-09-03 | |
| GHSA-8hcv-x26h-mcgp | CVE-2026-71430 | MODERATE |
node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length |
2026-08-06 | |
| GHSA-ghrq-5wpp-hxx5 | CVE-2026-52856 | HIGH |
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service |
2026-07-31 | |
| GHSA-33cg-gxv8-3p8g | CVE-2026-55514 | HIGH |
vLLM denial of service via prompt embeds on M-RoPE models |
2026-07-20 | |
| GHSA-m2jr-x4gq-5rmj | CVE-2026-10300 | LOW |
SGLang: Reachable Assertion via lora_path in LoRAManager enables remote Denial of Dervice |
2026-07-09 | |
| GHSA-63wg-wjjj-7cp8 | CVE-2026-52829 | HIGH | - |
Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update |
2026-07-02 |
| GHSA-c8w6-x74f-vmg3 | - | MODERATE | - |
zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers |
2026-07-02 |
| GHSA-8w8f-r2xv-4q4j | CVE-2026-55776 | MODERATE |
OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types |
2026-06-19 | |
| GHSA-56w8-48fp-6mgv | CVE-2025-47913 | HIGH |
golang.org/x/crypto/ssh/agent has a potential denial of service |
2026-06-19 | |
| GHSA-vghx-352f-93jm | CVE-2026-46543 | MODERATE | - |
nimiq-blockchain: Genesis batch set request |
2026-06-10 |
| GHSA-h9cc-w26m-j342 | CVE-2026-46542 | MODERATE | - |
nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points |
2026-06-10 |
| GHSA-44qj-cghf-9p97 | CVE-2026-44321 | HIGH |
free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) |
2026-06-08 | |
| GHSA-rxrq-fv76-26pr | CVE-2026-44319 | HIGH |
free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) |
2026-06-08 | |
| GHSA-q8hx-mm92-4wvg | CVE-2024-47763 | MODERATE | - |
wasmtime has a runtime crash when combining tail calls with trapping imports |
2026-06-08 |
| GHSA-29x4-r6jv-ff4w | CVE-2026-41585 | MODERATE | - |
Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients |
2026-05-12 |
| GHSA-452v-w3gx-72wg | CVE-2026-41584 | CRITICAL | - |
Zebra has rk Identity Point Panic in Transaction Verification |
2026-05-12 |
| GHSA-264v-m8fm-76jm | CVE-2026-34067 | LOW | - |
nimiq-transaction: Panic via `HistoryTreeProof` length mismatch |
2026-04-27 |
| GHSA-j99g-7rqw-q9jg | CVE-2026-34066 | MODERATE | - |
nimiq-blockchain: Peer-triggerable panic during history sync |
2026-04-27 |
| GHSA-fpjq-c37h-cqcv | CVE-2026-41485 | HIGH |
Kyverno Controller Denial of Service via forEach Mutation Panic |
2026-04-24 | |
| GHSA-48m6-486p-9j8p | CVE-2026-34069 | MODERATE | - |
nimiq-consensus panics via RequestMacroChain micro-block locator |
2026-04-15 |
| GHSA-xqmp-fxgv-xvq5 | CVE-2026-34219 | HIGH | - |
libp2p-gossipsub: Remote crash via unchecked Instant overflow in heartbeat backoff expiry handling |
2026-04-06 |
| GHSA-r3fr-7m74-q7g2 | CVE-2026-30867 | MODERATE | - |
CocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet Parsing |
2026-04-03 |
| GHSA-vxx9-2994-q338 | CVE-2026-32314 | HIGH | - |
Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145 |
2026-03-16 |