Suse CVE-2026-28224

Upgrade to Firebird version 5.0.4, 4.0.7, or 3.0.14 depending on your major version branch to receive the vendor-released patch that properly initializes the port_server_crypt_callback handler before processing cryptographic callback packets. Release artifacts are available at https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4, https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7, and https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14. If immediate patching is not feasible, implement network-layer compensating controls by restricting Firebird port access (default TCP 3050) to trusted IP addresses only via firewall rules or security groups, which prevents unauthenticated external attackers from reaching the vulnerable packet handler. Note that access restrictions will block legitimate remote clients unless they connect through VPN or other approved network paths, requiring application architecture review. Connection pooling proxies or reverse proxies cannot mitigate this issue as the vulnerability occurs during initial protocol negotiation before application-layer filtering. For embedded deployments with no network listeners, the vulnerability is not exploitable remotely but upgrading is still recommended for defense-in-depth.