Common Weakness Enumeration
CWE-617
AllowedReachable Assertion
Abstraction: Base · Status: Draft
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
1119 vulnerabilities reference this CWE, most recent first.
GHSA-CC7Q-GQFW-HRM4
Vulnerability from github – Published: 2026-07-22 15:31 – Updated: 2026-07-22 15:31
VLAI
Details
The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, named may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur.
This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-12617"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-22T15:16:51Z",
"severity": "HIGH"
},
"details": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
"id": "GHSA-cc7q-gqfw-hrm4",
"modified": "2026-07-22T15:31:26Z",
"published": "2026-07-22T15:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12617"
},
{
"type": "WEB",
"url": "https://downloads.isc.org/isc/bind9/9.20.26"
},
{
"type": "WEB",
"url": "https://kb.isc.org/docs/cve-2026-12617"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CC8X-CHX9-C63Q
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2022-05-24 19:11
VLAI
Details
In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.19, 9.17.16, and release 9.16.19-S1 of the BIND Supported Preview Edition.
{
"affected": [],
"aliases": [
"CVE-2021-25218"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-18T19:15:00Z",
"severity": "HIGH"
},
"details": "In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.19, 9.17.16, and release 9.16.19-S1 of the BIND Supported Preview Edition.",
"id": "GHSA-cc8x-chx9-c63q",
"modified": "2022-05-24T19:11:29Z",
"published": "2022-05-24T19:11:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25218"
},
{
"type": "WEB",
"url": "https://kb.isc.org/v1/docs/cve-2021-25218"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZPJCLGSR4BTGFLBLGIE5TEQP2SNJKGVL"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210909-0002"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/08/18/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/08/20/2"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CG96-Q9GQ-2PR7
Vulnerability from github – Published: 2023-11-02 15:30 – Updated: 2025-11-04 00:30
VLAI
Details
A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
Severity
6.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-38469"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-02T15:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.",
"id": "GHSA-cg96-q9gq-2pr7",
"modified": "2025-11-04T00:30:40Z",
"published": "2023-11-02T15:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38469"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-38469"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2191687"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00011.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CJ5V-4J3M-M6J5
Vulnerability from github – Published: 2026-09-18 18:31 – Updated: 2026-09-18 18:31
VLAI
Details
A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.
Severity
5.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-91147"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-18T17:17:05Z",
"severity": "MODERATE"
},
"details": "A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.",
"id": "GHSA-cj5v-4j3m-m6j5",
"modified": "2026-09-18T18:31:43Z",
"published": "2026-09-18T18:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91147"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-91147"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479230"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CJPH-QX8Q-WCX4
Vulnerability from github – Published: 2022-01-26 00:02 – Updated: 2022-01-28 00:02
VLAI
Details
There is an Assertion ''ecma_is_value_boolean (base_value)'' failed at /jerry-core/ecma/operations/ecma-get-put-value.c in Jerryscript 3.0.0.
{
"affected": [],
"aliases": [
"CVE-2021-44993"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-25T01:15:00Z",
"severity": "MODERATE"
},
"details": "There is an Assertion \u0027\u0027ecma_is_value_boolean (base_value)\u0027\u0027 failed at /jerry-core/ecma/operations/ecma-get-put-value.c in Jerryscript 3.0.0.",
"id": "GHSA-cjph-qx8q-wcx4",
"modified": "2022-01-28T00:02:34Z",
"published": "2022-01-26T00:02:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44993"
},
{
"type": "WEB",
"url": "https://github.com/jerryscript-project/jerryscript/issues/4876"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CMH2-2G79-CXCQ
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25
VLAI
Details
The function "Token& Scanner::peek" in scanner.cpp in yaml-cpp 0.5.3 and earlier allows remote attackers to cause a denial of service (assertion failure and application exit) via a '!2' string.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-11692"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-30T17:29:00Z",
"severity": "HIGH"
},
"details": "The function \"Token\u0026 Scanner::peek\" in scanner.cpp in yaml-cpp 0.5.3 and earlier allows remote attackers to cause a denial of service (assertion failure and application exit) via a \u0027!2\u0027 string.",
"id": "GHSA-cmh2-2g79-cxcq",
"modified": "2022-05-13T01:25:07Z",
"published": "2022-05-13T01:25:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11692"
},
{
"type": "WEB",
"url": "https://github.com/jbeder/yaml-cpp/issues/519"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202007-14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPCX-WWW7-V9F3
Vulnerability from github – Published: 2024-10-28 15:31 – Updated: 2024-10-28 15:31
VLAI
Details
Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-10455"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-28T14:15:04Z",
"severity": "HIGH"
},
"details": "Reachable Assertion in BPv7 parser in \u00b5D3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block",
"id": "GHSA-cpcx-www7-v9f3",
"modified": "2024-10-28T15:31:16Z",
"published": "2024-10-28T15:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10455"
},
{
"type": "WEB",
"url": "https://gitlab.com/d3tn/ud3tn/-/issues/227"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPHR-J5F7-39X9
Vulnerability from github – Published: 2022-05-14 03:15 – Updated: 2024-09-09 15:30
VLAI
Details
The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2016-9388"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-23T18:59:00Z",
"severity": "MODERATE"
},
"details": "The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.",
"id": "GHSA-cphr-j5f7-39x9",
"modified": "2024-09-09T15:30:36Z",
"published": "2022-05-14T03:15:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9388"
},
{
"type": "WEB",
"url": "https://github.com/mdadams/jasper/commit/411a4068f8c464e883358bf403a3e25158863823"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1208"
},
{
"type": "WEB",
"url": "https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1396962"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3693-1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/11/17/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94371"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPM7-PGMM-3MFR
Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2022-05-24 22:28
VLAI
Details
A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.
{
"affected": [],
"aliases": [
"CVE-2020-25709"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-18T12:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP\u2019s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.",
"id": "GHSA-cpm7-pgmm-3mfr",
"modified": "2022-05-24T22:28:33Z",
"published": "2022-05-24T22:28:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25709"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1899675"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00008.html"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212147"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4792"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Feb/14"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CPMQ-CRVM-2W5P
Vulnerability from github – Published: 2023-04-03 18:32 – Updated: 2023-04-11 09:30
VLAI
Details
A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in DoS.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-36440"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-03T16:15:00Z",
"severity": "HIGH"
},
"details": "A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in DoS.",
"id": "GHSA-cpmq-crvm-2w5p",
"modified": "2023-04-11T09:30:24Z",
"published": "2023-04-03T18:32:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36440"
},
{
"type": "WEB",
"url": "https://github.com/spwpun/pocs"
},
{
"type": "WEB",
"url": "https://github.com/spwpun/pocs/blob/main/frr-bgpd.md"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HU4PKLUVB5CTMOVQ2GV33TNUNMJCBGD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBXEXL2ZQBWCBLNUP6P67FHECXQWSK3L"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GM66PNHGCXZU66LQCTP2FSJLFF6CVMSI"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HU4PKLUVB5CTMOVQ2GV33TNUNMJCBGD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBXEXL2ZQBWCBLNUP6P67FHECXQWSK3L"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GM66PNHGCXZU66LQCTP2FSJLFF6CVMSI"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5495"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
Mitigation
Implementation
Strategy: Input Validation
Perform input validation on user data.
No CAPEC attack patterns related to this CWE.