Denial of Service Vulnerability in Firebird Database Management System
CVE-2026-28214
6MEDIUM
What is CVE-2026-28214?
The Firebird Relational Database Management System contains a vulnerability in the ClumpletReader::getClumpletSize() function that can lead to an infinite loop when parsing a Wide type clumplet. This issue affects authenticated users with INSERT privileges who can exploit the vulnerability through a crafted Batch Parameter Block, potentially resulting in a Denial of Service attack against the database server. The issue has been addressed in versions 5.0.4, 4.0.7, and 3.0.14.
Affected Version(s)
firebird >= 3.0.0, < 3.0.14 < 3.0.0, 3.0.14
firebird >= 4.0.0, < 4.0.7 < 4.0.0, 4.0.7
firebird >= 5.0.0, < 5.0.4 < 5.0.0, 5.0.4