CVE-2026-35215

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does not validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor is later used to calculate the number of slice items, causing a division by zero. An unauthenticated attacker can exploit this by sending a crafted slice packet to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14	Release Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7	Release Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4	Release Notes
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-g99w-prq5-29c6	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:firebirdsql:firebird::::::::
	cpe:2.3:a:firebirdsql:firebird::::::::
	cpe:2.3:a:firebirdsql:firebird::::::::

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Firebird es un sistema de gestión de bases de datos relacionales de código abierto. En versiones anteriores a la 5.0.4, 4.0.7 y 3.0.14, la función sdl_desc() no valida la longitud de un descriptor SDL decodificado de un paquete de segmento. Un descriptor de longitud cero se utiliza posteriormente para calcular el número de elementos de segmento, causando una división por cero. Un atacante no autenticado puede explotar esto enviando un paquete de segmento manipulado para bloquear el servidor. Este problema ha sido solucionado en las versiones 5.0.4, 4.0.7 y 3.0.14.

Information

Published : 2026-04-17 20:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-35215

Mitre link : CVE-2026-35215

CVE.ORG link : CVE-2026-35215

JSON object : View

Products Affected

firebirdsql

firebird

CWE

CWE-369

Divide By Zero

{"id": "CVE-2026-35215", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35215", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T15:40:04.996968Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FirebirdSQL", "product": "firebird", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.0.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.7"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.4"}]}]}], "published": "2026-04-17T20:16:35.240", "references": [{"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-g99w-prq5-29c6", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-369"}]}], "descriptions": [{"lang": "en", "value": "Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does not validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor is later used to calculate the number of slice items, causing a division by zero. An unauthenticated attacker can exploit this by sending a crafted slice packet to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14."}, {"lang": "es", "value": "Firebird es un sistema de gesti\u00f3n de bases de datos relacionales de c\u00f3digo abierto. En versiones anteriores a la 5.0.4, 4.0.7 y 3.0.14, la funci\u00f3n sdl_desc() no valida la longitud de un descriptor SDL decodificado de un paquete de segmento. Un descriptor de longitud cero se utiliza posteriormente para calcular el n\u00famero de elementos de segmento, causando una divisi\u00f3n por cero. Un atacante no autenticado puede explotar esto enviando un paquete de segmento manipulado para bloquear el servidor. Este problema ha sido solucionado en las versiones 5.0.4, 4.0.7 y 3.0.14."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A79C5C5-09BC-4F38-8B00-F643818CC87D", "versionEndExcluding": "3.0.14", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4BC24D2-FBF7-4308-9914-6079DBDF88FA", "versionEndExcluding": "4.0.7", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "938978A3-90BE-4223-BDFC-5310A7C78D9B", "versionEndExcluding": "5.0.4", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}