Common Weakness Enumeration
CWE-617
AllowedReachable Assertion
Abstraction: Base · Status: Draft
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
1119 vulnerabilities reference this CWE, most recent first.
GHSA-48MV-8MQ9-RHMF
Vulnerability from github – Published: 2022-08-04 00:00 – Updated: 2022-08-10 00:00
VLAI
Details
The assertion `stmt->Dbc->FirstStmt' failed in MonetDB Database Server v11.43.13.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-34967"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-03T02:15:00Z",
"severity": "HIGH"
},
"details": "The assertion `stmt-\u003eDbc-\u003eFirstStmt\u0027 failed in MonetDB Database Server v11.43.13.",
"id": "GHSA-48mv-8mq9-rhmf",
"modified": "2022-08-10T00:00:20Z",
"published": "2022-08-04T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34967"
},
{
"type": "WEB",
"url": "https://github.com/MonetDB/MonetDB/issues/7306"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-48PM-MHWH-G6MR
Vulnerability from github – Published: 2022-04-15 00:00 – Updated: 2022-04-22 00:01
VLAI
Details
There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-27448"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-14T13:15:00Z",
"severity": "HIGH"
},
"details": "There is an Assertion failure in MariaDB Server v10.9 and below via \u0027node-\u003epcur-\u003erel_pos == BTR_PCUR_ON\u0027 at /row/row0mysql.cc.",
"id": "GHSA-48pm-mhwh-g6mr",
"modified": "2022-04-22T00:01:01Z",
"published": "2022-04-15T00:00:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27448"
},
{
"type": "WEB",
"url": "https://jira.mariadb.org/browse/MDEV-28095"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220526-0006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-48RG-6M8G-CQGC
Vulnerability from github – Published: 2022-05-24 17:48 – Updated: 2024-03-21 03:34
VLAI
Details
Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2019-25041"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-27T06:15:00Z",
"severity": "HIGH"
},
"details": "Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy.",
"id": "GHSA-48rg-6m8g-cqgc",
"modified": "2024-03-21T03:34:04Z",
"published": "2022-05-24T17:48:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25041"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html"
},
{
"type": "WEB",
"url": "https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210507-0007"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4CJW-RPHC-C5V6
Vulnerability from github – Published: 2026-06-15 21:30 – Updated: 2026-07-30 09:31
VLAI
Details
A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-52718"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T20:16:32Z",
"severity": "MODERATE"
},
"details": "A denial of service vulnerability was found in GStreamer\u0027s AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash.",
"id": "GHSA-4cjw-rphc-c5v6",
"modified": "2026-07-30T09:31:16Z",
"published": "2026-06-15T21:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52718"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36749"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36834"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:47069"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:47070"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:47071"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:47717"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-52718"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486328"
},
{
"type": "WEB",
"url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5103"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4CXM-8XRJ-7C53
Vulnerability from github – Published: 2022-05-13 01:39 – Updated: 2022-05-13 01:39
VLAI
Details
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-0376"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-09T17:29:00Z",
"severity": "HIGH"
},
"details": "The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.",
"id": "GHSA-4cxm-8xrj-7c53",
"modified": "2022-05-13T01:39:57Z",
"published": "2022-05-13T01:39:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0376"
},
{
"type": "WEB",
"url": "https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd"
},
{
"type": "WEB",
"url": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html"
},
{
"type": "WEB",
"url": "https://trac.torproject.org/projects/tor/ticket/22494"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3877"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4G3H-V9FP-PGM4
Vulnerability from github – Published: 2023-11-02 15:30 – Updated: 2025-11-04 00:30
VLAI
Details
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
Severity
6.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-38472"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-02T15:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.",
"id": "GHSA-4g3h-v9fp-pgm4",
"modified": "2025-11-04T00:30:41Z",
"published": "2023-11-02T15:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38472"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-38472"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2191692"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00011.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4GRG-RGMH-VH43
Vulnerability from github – Published: 2023-03-10 21:30 – Updated: 2023-03-16 18:30
VLAI
Details
Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-40527"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-10T21:15:00Z",
"severity": "HIGH"
},
"details": "Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.",
"id": "GHSA-4grg-rgmh-vh43",
"modified": "2023-03-16T18:30:30Z",
"published": "2023-03-10T21:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40527"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/march-2023-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4HG6-GWCJ-8XVF
Vulnerability from github – Published: 2025-10-01 12:30 – Updated: 2026-01-16 21:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
fbdev: imxfb: Removed unneeded release_mem_region
Remove unnecessary release_mem_region from the error path to prevent mem region from being released twice, which could avoid resource leak or other unexpected issues.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-53448"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-01T12:15:41Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: imxfb: Removed unneeded release_mem_region\n\nRemove unnecessary release_mem_region from the error path to prevent\nmem region from being released twice, which could avoid resource leak\nor other unexpected issues.",
"id": "GHSA-4hg6-gwcj-8xvf",
"modified": "2026-01-16T21:30:29Z",
"published": "2025-10-01T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53448"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/38282a92c30422836d49e519bd109237f86a0888"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/45fcc058a75bf5d65cf4c32da44a252fbe873cd4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6aa851f6276fa08cd59b044bc2b803c49edf58a2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4J82-5CCR-4R8V
Vulnerability from github – Published: 2022-02-10 00:34 – Updated: 2024-11-07 22:27
VLAI
Summary
`CHECK`-failures in `TensorByteSize` in Tensorflow
Details
Impact
A malicious user can cause a denial of service by altering a SavedModel such that TensorByteSize would trigger CHECK failures.
int64_t TensorByteSize(const TensorProto& t) {
// num_elements returns -1 if shape is not fully defined.
int64_t num_elems = TensorShape(t.tensor_shape()).num_elements();
return num_elems < 0 ? -1 : num_elems * DataTypeSize(t.dtype());
}
TensorShape constructor throws a CHECK-fail if shape is partial or has a number of elements that would overflow the size of an int. The PartialTensorShape constructor instead does not cause a CHECK-abort if the shape is partial, which is exactly what this function needs to be able to return -1.
Patches
We have patched the issue in GitHub commit c2426bba00a01de6913738df8fa78e0215fcce02.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.7.0"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.7.0"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.7.0"
]
}
],
"aliases": [
"CVE-2022-23582"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": true,
"github_reviewed_at": "2022-02-04T19:53:00Z",
"nvd_published_at": "2022-02-04T23:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nA malicious user can cause a denial of service by altering a `SavedModel` such that [`TensorByteSize`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/attr_value_util.cc#L46-L50) would trigger `CHECK` failures.\n\n```cc\nint64_t TensorByteSize(const TensorProto\u0026 t) {\n // num_elements returns -1 if shape is not fully defined.\n int64_t num_elems = TensorShape(t.tensor_shape()).num_elements();\n return num_elems \u003c 0 ? -1 : num_elems * DataTypeSize(t.dtype());\n}\n```\n`TensorShape` constructor throws a `CHECK`-fail if shape is partial or has a number of elements that would overflow the size of an `int`. The `PartialTensorShape` constructor instead does not cause a `CHECK`-abort if the shape is partial, which is exactly what this function needs to be able to return `-1`.\n\n### Patches\nWe have patched the issue in GitHub commit [c2426bba00a01de6913738df8fa78e0215fcce02](https://github.com/tensorflow/tensorflow/commit/c2426bba00a01de6913738df8fa78e0215fcce02).\n\nThe fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.",
"id": "GHSA-4j82-5ccr-4r8v",
"modified": "2024-11-07T22:27:53Z",
"published": "2022-02-10T00:34:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4j82-5ccr-4r8v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23582"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/commit/c2426bba00a01de6913738df8fa78e0215fcce02"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-91.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-146.yaml"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/attr_value_util.cc#L46-L50"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "`CHECK`-failures in `TensorByteSize` in Tensorflow"
}
GHSA-4JW8-CP5G-24J2
Vulnerability from github – Published: 2026-04-22 15:31 – Updated: 2026-07-04 12:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
Replace BUG_ON() with proper error handling when inline data size exceeds PAGE_SIZE. This prevents kernel panic and allows the system to continue running while properly reporting the filesystem corruption.
The error is logged via ext4_error_inode(), the buffer head is released to prevent memory leak, and -EFSCORRUPTED is returned to indicate filesystem corruption.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-31451"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-22T14:16:39Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: replace BUG_ON with proper error handling in ext4_read_inline_folio\n\nReplace BUG_ON() with proper error handling when inline data size\nexceeds PAGE_SIZE. This prevents kernel panic and allows the system to\ncontinue running while properly reporting the filesystem corruption.\n\nThe error is logged via ext4_error_inode(), the buffer head is released\nto prevent memory leak, and -EFSCORRUPTED is returned to indicate\nfilesystem corruption.",
"id": "GHSA-4jw8-cp5g-24j2",
"modified": "2026-07-04T12:30:27Z",
"published": "2026-04-22T15:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31451"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3462a3f0716d27af51896dc8688bcf0628fb17ee"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/356227096eb66e41b23caf7045e6304877322edf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/636e8d85a36ab6c31aafd04ee66a69b18eebee7b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/65c6c30ce6362c1c684568744ea510c921a756cd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/823849a26af089ffc5dfdd2ae4b9d446b46a0cda"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a7d600e04732a7d29b107c91fe3aec64cf6ce7f2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/af25a6affeac4919e8d8c5cccc01a9d53478447e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
Mitigation
Implementation
Strategy: Input Validation
Perform input validation on user data.
No CAPEC attack patterns related to this CWE.