CWE-617Reachable Assertion

Abstraction: Base · CVEs in our corpus: 913

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service. For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.

Last updated: 15 October 2026 20:36 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
ID.RA-01
SA-11 Developer Testing and Evaluation
SI-10 Information Input Validation

Detect

Catch it (CSF Detect / Respond)

DE.CM-09

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2015-5477` KEV	8.5	7.5	0.9941	2015-07-29
`CVE-2020-8617`	8.5	7.5	0.9342	2020-05-19
`CVE-2006-5779`	8.4	7.5	0.7686	2006-11-07
`CVE-2020-36222`	8.4	7.5	0.7724	2021-01-26
`CVE-2021-27212`	8.3	7.5	0.6611	2021-02-14
`CVE-2018-5740`	8.1	7.5	0.5962	2019-01-16
`CVE-2016-8864`	7.6	7.5	0.3873	2016-11-02
`CVE-2019-9795`	7.6	9.8	0.0170	2019-04-26
`CVE-2018-12543`	7.5	7.5	0.3601	2018-11-15
`CVE-2020-3615`	7.4	9.8	0.0075	2020-06-02
`CVE-2024-35884`	7.4	9.8	0.0069	2024-05-19
`CVE-2022-3488`	7.1	7.5	0.1919	2023-01-26
`CVE-2023-49286`	7.1	8.6	0.1035	2023-12-04
`CVE-2020-12417`	7.0	8.8	0.0268	2020-07-09
`CVE-2022-3924`	7.0	7.5	0.1611	2023-01-26
`CVE-2023-28425`	7.0	5.5	0.5853	2023-03-20
`CVE-2026-27809`	7.0	9.1	0.0070	2026-02-26
`CVE-2017-7478`	6.9	7.5	0.1378	2017-05-15
`CVE-2006-4095`	6.8	7.5	0.1197	2006-09-06
`CVE-2011-3596`	6.8	7.5	0.1105	2019-11-26
`CVE-2020-6617`	6.8	8.8	0.0114	2020-01-08
`CVE-2020-6619`	6.8	8.8	0.0114	2020-01-08
`CVE-2020-6623`	6.8	8.8	0.0145	2020-01-08
`CVE-2020-15670`	6.8	8.8	0.0107	2020-10-01
`CVE-2020-36230`	6.8	7.5	0.1197	2021-01-26