CVE-2026-27890: falha de alta gravidade em FirebirdSQL firebird
Firebird has Pre-Auth DOS when Processing Out of Order CNCT_specific_data Segments
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.5%
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow() method computes a negative size value, causing a SIGSEGV crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Produtos afetados
FirebirdSQL · firebirdCVEs relacionadas — FirebirdSQL firebird
No mesmo produto, das mais perigosas para as menos.
CVE-2026-28214MEDIUMFirebird server hangs when using specific clumplet on batch creationEPSS 1.1%CVE-2026-40342CRITICALFirebird: Path Traversal + Arbitrary File Write Leads to Remote Code ExecutionEPSS 0.7%CVE-2025-54989MEDIUMFirebird XDR Message Parsing NULL Pointer Dereference Denial-of-Service VulnerabilityEPSS 0.7%CVE-2023-41038HIGHServer crash when using specific form of SET BIND statementEPSS 0.7%CVE-2025-24975HIGHFirebird Non-Authorized Access to Encrypted Database Using Execute Statement on ExternalEPSS 0.6%CVE-2026-33337HIGHFirebird has a buffer overflow when parsing corrupted slice packetsEPSS 0.5%