CWE-617: Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service. For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.

Consequences

• Availability: DoS: Crash, Exit, or Restart

How to prevent it

• Implementation: Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
• Implementation: Perform input validation on user data.

Recent advisories

• GHSA-gq5q-89c7-vhvx — vLLM DeepSeek-OCR image processing vulnerable to denial of service
• GHSA-qrxm-fqhp-jwvm — undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
• GHSA-ph72-cqr5-qpp7 — vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
• GHSA-ph3r-5jfg-f84f — vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
• PYSEC-2026-4005 — vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block…
• GHSA-33cg-gxv8-3p8g — vLLM denial of service via prompt embeds on M-RoPE models
• GHSA-63wg-wjjj-7cp8 — Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update
• GHSA-c8w6-x74f-vmg3 — zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers
• GHSA-8w8f-r2xv-4q4j — OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types
• GHSA-q8gq-377p-jq3r — vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
• GHSA-fpjq-c37h-cqcv — Kyverno Controller Denial of Service via forEach Mutation Panic
• GHSA-29x4-r6jv-ff4w — Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients
• GHSA-452v-w3gx-72wg — Zebra has rk Identity Point Panic in Transaction Verification
• GO-2025-4116 — golang.org/x/crypto/ssh/agent has a potential denial of service
• GHSA-q8hx-mm92-4wvg — wasmtime has a runtime crash when combining tail calls with trapping imports

All advisories for CWE-617