EUVD-2026-23490Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does not validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor is later used to calculate the number of slice items, causing a division by zero. An unauthenticated attacker can exploit this by sending a crafted slice packet to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
AnalysisAI
Firebird database server crashes via crafted slice packet exploiting zero-length SDL descriptor validation flaw. Remote unauthenticated attackers can trigger division-by-zero errors in the sdl_desc() function to cause denial of service against Firebird versions prior to 5.0.4, 4.0.7, and 3.0.14. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation with no authentication required. EPSS data not available; no public exploit identified at time of analysis, though technical details in GitHub advisory may facilitate reproduction.
Technical ContextAI
Firebird is an open-source SQL relational database management system derived from Borland InterBase, widely used in embedded and enterprise applications. The vulnerability resides in the sdl_desc() function responsible for processing SDL (Slice Description Language) descriptors from slice packets - a Firebird-specific protocol mechanism for handling array data. CWE-369 (Divide By Zero) occurs when the function fails to validate that a decoded SDL descriptor has non-zero length before using it as a divisor to calculate slice item counts. When a zero-length descriptor is processed, the subsequent arithmetic operation triggers a division-by-zero exception that crashes the database server process. This is a classic input validation failure in network protocol parsing code affecting the core database engine across multiple major version branches (3.x, 4.x, 5.x).
RemediationAI
Immediately upgrade to vendor-released patched versions: Firebird 5.0.4 (https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4), 4.0.7 (https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7), or 3.0.14 (https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14) depending on your major version branch. No workarounds are documented in the security advisory. If immediate patching is not feasible, implement network-level compensating controls: restrict Firebird port 3050/TCP access to trusted IP ranges only using firewall rules (eliminates remote unauthenticated attack surface but breaks legitimate remote database access), deploy a database proxy or gateway with protocol inspection capabilities to filter malformed slice packets (requires specialized tooling and may impact performance), or temporarily disable network listener and run Firebird in local-only mode if application architecture permits (severe functionality limitation). All mitigations except patching carry operational trade-offs and should be considered temporary.
Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windo
Firebird is a relational database. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. Public ex
FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to
Remote code execution in Firebird RDBMS versions prior to 5.0.4, 4.0.7, and 3.0.14 allows authenticated users with CREAT
Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticate
The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a de
Null pointer dereference in Firebird SQL server causes remote denial-of-service when unauthenticated attackers send malf
Remote denial-of-service in Firebird database server versions prior to 5.0.4, 4.0.7, and 3.0.14 allows unauthenticated n
Information disclosure in Firebird 3.x client library when connecting to Firebird 4+ servers allows local authenticated
Remote denial-of-service in Firebird Database Server versions prior to 5.0.4, 4.0.7, and 3.0.14 allows unauthenticated n
Buffer overflow in Firebird RDBMS allows remote unauthenticated attackers to crash database servers via malformed slice
Remote unauthenticated denial of service in Firebird SQL database server versions prior to 6.0.0/5.0.4/4.0.7/3.0.14 allo
Same weakness CWE-369 – Divide By Zero
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today