Denial of Service Vulnerability in Firebird Database Management System
CVE-2026-35215
7.5HIGH
What is CVE-2026-35215?
Firebird, an open-source relational database management system, suffers from a flaw in the sdl_desc() function present in versions before 5.0.4, 4.0.7, and 3.0.14. This flaw involves improper validation of the length of decoded SDL descriptors extracted from slice packets. An unauthenticated attacker can exploit this vulnerability by sending a specifically crafted slice packet that can lead to a division by zero during calculations of slice items, resulting in a server crash. Users are encouraged to update to the latest fixed versions to mitigate this risk.
Affected Version(s)
firebird >= 3.0.0, < 3.0.14 < 3.0.0, 3.0.14
firebird >= 4.0.0, < 4.0.7 < 4.0.0, 4.0.7
firebird >= 5.0.0, < 5.0.4 < 5.0.0, 5.0.4