CWE-617
AllowedReachable Assertion
Abstraction: Base · Status: Draft
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
989 vulnerabilities reference this CWE, most recent first.
GHSA-5J7P-JHWW-XP9M
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25An assertion failure was discovered in wasm::WasmBinaryBuilder::getType() in wasm-binary.cpp in Binaryen 1.38.22. This allows remote attackers to cause a denial of service (failed assertion and crash) via a crafted wasm file.
{
"affected": [],
"aliases": [
"CVE-2019-7662"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-09T16:29:00Z",
"severity": "HIGH"
},
"details": "An assertion failure was discovered in wasm::WasmBinaryBuilder::getType() in wasm-binary.cpp in Binaryen 1.38.22. This allows remote attackers to cause a denial of service (failed assertion and crash) via a crafted wasm file.",
"id": "GHSA-5j7p-jhww-xp9m",
"modified": "2022-05-13T01:25:51Z",
"published": "2022-05-13T01:25:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7662"
},
{
"type": "WEB",
"url": "https://github.com/WebAssembly/binaryen/issues/1872"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5J84-2MFG-4V5R
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-28 00:00Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code. This vulnerability affects Firefox < 86.
{
"affected": [],
"aliases": [
"CVE-2021-23970"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-26T02:15:00Z",
"severity": "MODERATE"
},
"details": "Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code. This vulnerability affects Firefox \u003c 86.",
"id": "GHSA-5j84-2mfg-4v5r",
"modified": "2022-05-28T00:00:22Z",
"published": "2022-05-24T17:43:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23970"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1681724"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202104-10"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2021-07"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5JF6-RM4J-MPJR
Vulnerability from github – Published: 2025-01-22 00:33 – Updated: 2025-01-23 21:31A reachable assertion in the oai_nas_5gmm_decode function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.
{
"affected": [],
"aliases": [
"CVE-2024-24428"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T23:15:12Z",
"severity": "HIGH"
},
"details": "A reachable assertion in the oai_nas_5gmm_decode function of Open5GS \u003c= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.",
"id": "GHSA-5jf6-rm4j-mpjr",
"modified": "2025-01-23T21:31:51Z",
"published": "2025-01-22T00:33:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24428"
},
{
"type": "WEB",
"url": "https://cellularsecurity.org/ransacked"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5JWJ-C4GJ-X35C
Vulnerability from github – Published: 2025-01-22 15:32 – Updated: 2025-01-24 00:31Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a sufficiently large ASN.1 packet over the S1AP interface. An attacker may repeatedly send such an oversized packet to cause the ogs_sctp_recvmsg routine to reach an unexpected network state and crash, leading to denial of service.
{
"affected": [],
"aliases": [
"CVE-2023-37013"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-22T15:15:10Z",
"severity": "HIGH"
},
"details": "Open5GS MME versions \u003c= 2.6.4 contains an assertion that can be remotely triggered via a sufficiently large ASN.1 packet over the S1AP interface. An attacker may repeatedly send such an oversized packet to cause the `ogs_sctp_recvmsg` routine to reach an unexpected network state and crash, leading to denial of service.",
"id": "GHSA-5jwj-c4gj-x35c",
"modified": "2025-01-24T00:31:46Z",
"published": "2025-01-22T15:32:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37013"
},
{
"type": "WEB",
"url": "https://cellularsecurity.org/ransacked"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5M32-X2F7-RPGH
Vulnerability from github – Published: 2025-12-02 03:31 – Updated: 2025-12-02 15:30In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661189; Issue ID: MSV-4298.
{
"affected": [],
"aliases": [
"CVE-2025-20791"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-02T03:16:20Z",
"severity": "MODERATE"
},
"details": "In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661189; Issue ID: MSV-4298.",
"id": "GHSA-5m32-x2f7-rpgh",
"modified": "2025-12-02T15:30:31Z",
"published": "2025-12-02T03:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20791"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/December-2025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5P4X-7QQV-Q472
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-07-14 21:31In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate group add input before caching
[BUG] OCFS2_IOC_GROUP_ADD can trigger a BUG_ON in ocfs2_set_new_buffer_uptodate():
kernel BUG at fs/ocfs2/uptodate.c:509! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_set_new_buffer_uptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509 Code: ffffe88f 42b9fe4c 89e64889 dfe8b4df Call Trace: ocfs2_group_add+0x3f1/0x1510 fs/ocfs2/resize.c:507 ocfs2_ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7bbfb55a966d
[CAUSE] ocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a user-controlled group block before ocfs2_verify_group_and_input() validates that block number. That helper is only valid for newly allocated metadata and asserts that the block is not already present in the chosen metadata cache. The code also uses INODE_CACHE(inode) even though the group descriptor belongs to main_bm_inode and later journal accesses use that cache context instead.
[FIX] Validate the on-disk group descriptor before caching it, then add it to the metadata cache tracked by INODE_CACHE(main_bm_inode). Keep the validation failure path separate from the later cleanup path so we only remove the buffer from that cache after it has actually been inserted. This keeps the group buffer lifetime consistent across validation, journaling, and cleanup.
{
"affected": [],
"aliases": [
"CVE-2026-53039"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:15Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate group add input before caching\n\n[BUG]\nOCFS2_IOC_GROUP_ADD can trigger a BUG_ON in\nocfs2_set_new_buffer_uptodate():\n\nkernel BUG at fs/ocfs2/uptodate.c:509!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:ocfs2_set_new_buffer_uptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509\nCode: ffffe88f 42b9fe4c 89e64889 dfe8b4df\nCall Trace:\n ocfs2_group_add+0x3f1/0x1510 fs/ocfs2/resize.c:507\n ocfs2_ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7bbfb55a966d\n\n[CAUSE]\nocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a\nuser-controlled group block before ocfs2_verify_group_and_input()\nvalidates that block number. That helper is only valid for newly\nallocated metadata and asserts that the block is not already present in\nthe chosen metadata cache. The code also uses INODE_CACHE(inode) even\nthough the group descriptor belongs to main_bm_inode and later journal\naccesses use that cache context instead.\n\n[FIX]\nValidate the on-disk group descriptor before caching it, then add it to\nthe metadata cache tracked by INODE_CACHE(main_bm_inode). Keep the\nvalidation failure path separate from the later cleanup path so we only\nremove the buffer from that cache after it has actually been inserted.\nThis keeps the group buffer lifetime consistent across validation,\njournaling, and cleanup.",
"id": "GHSA-5p4x-7qqv-q472",
"modified": "2026-07-14T21:31:29Z",
"published": "2026-06-24T18:32:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53039"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/22544ddedf381ed5191cfc783aea8d6c936bc201"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6c5e70409c1961fe1278968f038eaaed6cc1145a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/70b672833f4025341c11b22c7f83778a5cd611bc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/76bd722db0a92b84ccd99e03796a0b6f1ae71c31"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aed87e866d1a321edb9703563c2faa8fec89835d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b9ae3942deec4c9e3fa2070521f90910f7490011"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e7c2cb552e6eb85c0f5aefdd7f0f7c3c8591a6a3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f7e139d7563f6947ad509fb468903941d0bb7ddd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5P95-6QMC-HJQR
Vulnerability from github – Published: 2022-06-11 00:00 – Updated: 2022-06-18 00:00There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS scan.
{
"affected": [],
"aliases": [
"CVE-2022-32978"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-10T15:15:00Z",
"severity": "MODERATE"
},
"details": "There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS scan.",
"id": "GHSA-5p95-6qmc-hjqr",
"modified": "2022-06-18T00:00:23Z",
"published": "2022-06-11T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32978"
},
{
"type": "WEB",
"url": "https://github.com/thorfdbg/libjpeg/issues/75"
},
{
"type": "WEB",
"url": "https://github.com/thorfdbg/libjpeg/commit/4746b577931e926a49e50de9720a4946de3069a7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5Q6F-3G3M-RJW9
Vulnerability from github – Published: 2024-05-05 00:30 – Updated: 2024-07-03 18:38Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm_state_authentication in amf/gmm-sm.c for != OGS_ERROR.
{
"affected": [],
"aliases": [
"CVE-2024-34475"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-05T00:15:07Z",
"severity": "HIGH"
},
"details": "Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm_state_authentication in amf/gmm-sm.c for != OGS_ERROR.",
"id": "GHSA-5q6f-3g3m-rjw9",
"modified": "2024-07-03T18:38:55Z",
"published": "2024-05-05T00:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34475"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/pull/3122"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/compare/v2.7.0...v2.7.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5QG6-2968-FXG3
Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2022-05-24 17:31receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.
{
"affected": [],
"aliases": [
"CVE-2020-27638"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-22T13:15:00Z",
"severity": "HIGH"
},
"details": "receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.",
"id": "GHSA-5qg6-2968-fxg3",
"modified": "2022-05-24T17:31:59Z",
"published": "2022-05-24T17:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27638"
},
{
"type": "WEB",
"url": "https://github.com/NeoRaider/fastd/commit/737925113363b6130879729cdff9ccc46c33eaea"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/972521"
},
{
"type": "WEB",
"url": "https://fastd.readthedocs.io/en/stable/releases/v21.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00025.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2LNSF2LI4RQ7BVGHTJQUJWP7RVGHDTK"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GUZ3AGTAXH7OOP45F5WXBVRQ3IDWUR7M"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSMH65GHKHMJAK2VMPROIPIUS4IA63CW"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5QG8-89VJ-3364
Vulnerability from github – Published: 2024-12-28 12:30 – Updated: 2025-12-15 21:30In the Linux kernel, the following vulnerability has been resolved:
media: atomisp: Add check for rgby_data memory allocation failure
In ia_css_3a_statistics_allocate(), there is no check on the allocation result of the rgby_data memory. If rgby_data is not successfully allocated, it may trigger the assert(host_stats->rgby_data) assertion in ia_css_s3a_hmem_decode(). Adding a check to fix this potential issue.
{
"affected": [],
"aliases": [
"CVE-2024-56705"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-28T10:15:19Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: atomisp: Add check for rgby_data memory allocation failure\n\nIn ia_css_3a_statistics_allocate(), there is no check on the allocation\nresult of the rgby_data memory. If rgby_data is not successfully\nallocated, it may trigger the assert(host_stats-\u003ergby_data) assertion in\nia_css_s3a_hmem_decode(). Adding a check to fix this potential issue.",
"id": "GHSA-5qg8-89vj-3364",
"modified": "2025-12-15T21:30:27Z",
"published": "2024-12-28T12:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56705"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/02a97d9d7ff605fa4a1f908d1bd3ad8573234b61"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0c24b82bc4d12c6a58ceacbf2598cd4df63abf9a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0c25ab93f2878cab07d37ca5afd302283201e5af"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4676e50444046b498555b849e6080a5c78cdda9b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/74aa783682c4d78c69d87898e40c78df1fec204e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8066badaf7463194473fb4be19dbe50b11969aa0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ed61c59139509f76d3592683c90dc3fdc6e23cd6"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
Mitigation
Strategy: Input Validation
Perform input validation on user data.
No CAPEC attack patterns related to this CWE.