Authentication Flaw in Firebird Open-Source Database System
CVE-2026-27890
8.2HIGH
What is CVE-2026-27890?
Firebird, an open-source relational database management system, has a vulnerability that arises from the assumption of strictly ascending order for CNCT_specific_data segments during the authentication process. In affected versions prior to 5.0.4, 4.0.7, and 3.0.14, if the segments are received out of order, the Array class's grow() method may calculate a negative size, leading to a server crash (SIGSEGV). This weakness is exploitable by an unauthenticated attacker with knowledge of the server's IP and port, allowing potential disruption of service.
Affected Version(s)
firebird >= 3.0.0, < 3.0.14 < 3.0.0, 3.0.14
firebird >= 4.0.0, < 4.0.7 < 4.0.0, 4.0.7
firebird >= 5.0.0, < 5.0.4 < 5.0.0, 5.0.4