CVE-2026-27890

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27890", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T15:19:29.716Z", "datePublished": "2026-04-17T18:14:29.433Z", "dateUpdated": "2026-04-17T18:50:22.134Z"}, "containers": {"cna": {"title": "Firebird has Pre-Auth DOS when Processing Out of Order CNCT_specific_data Segments", "problemTypes": [{"descriptions": [{"cweId": "CWE-119", "lang": "en", "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-6crx-4g37-7j49", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-6crx-4g37-7j49"}, {"name": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14"}, {"name": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7"}, {"name": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4"}], "affected": [{"vendor": "FirebirdSQL", "product": "firebird", "versions": [{"version": ">= 3.0.0, < 3.0.14", "status": "affected"}, {"version": ">= 4.0.0, < 4.0.7", "status": "affected"}, {"version": ">= 5.0.0, < 5.0.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T18:36:11.924Z"}, "descriptions": [{"lang": "en", "value": "Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow() method computes a negative size value, causing a SIGSEGV crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14."}], "source": {"advisory": "GHSA-6crx-4g37-7j49", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T18:50:13.916401Z", "id": "CVE-2026-27890", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T18:50:22.134Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27890", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T18:50:13.916401Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T18:50:18.684Z"}}], "cna": {"title": "Firebird has Pre-Auth DOS when Processing Out of Order CNCT_specific_data Segments", "source": {"advisory": "GHSA-6crx-4g37-7j49", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "FirebirdSQL", "product": "firebird", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.0.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.7"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.4"}]}], "references": [{"url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-6crx-4g37-7j49", "name": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-6crx-4g37-7j49", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14", "name": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7", "name": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4", "name": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow() method computes a negative size value, causing a SIGSEGV crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T18:36:11.924Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27890", "state": "PUBLISHED", "dateUpdated": "2026-04-17T18:50:22.134Z", "dateReserved": "2026-02-24T15:19:29.716Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T18:14:29.433Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "firebird", "vendor": "FirebirdSQL", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.0.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.7"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "matchCriteriaId": "53D811A2-F880-46E9-9F7F-1CE3AC487F67", "versionEndExcluding": "3.0.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4BC24D2-FBF7-4308-9914-6079DBDF88FA", "versionEndExcluding": "4.0.7", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "matchCriteriaId": "938978A3-90BE-4223-BDFC-5310A7C78D9B", "versionEndExcluding": "5.0.4", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow() method computes a negative size value, causing a SIGSEGV crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14."}, {"lang": "es", "value": "Firebird es un sistema de gesti\u00f3n de bases de datos relacionales de c\u00f3digo abierto. En versiones anteriores a la 5.0.4, 4.0.7 y 3.0.14, al procesar segmentos CNCT_specific_data durante la autenticaci\u00f3n, el servidor asume que los segmentos llegan en orden estrictamente ascendente. Si los segmentos llegan desordenados, el m\u00e9todo grow() de la clase Array calcula un valor de tama\u00f1o negativo, causando un fallo SIGSEGV. Un atacante no autenticado que conoce solo la IP y el puerto del servidor puede explotar esto para bloquear el servidor. Este problema ha sido solucionado en las versiones 5.0.4, 4.0.7 y 3.0.14."}], "id": "CVE-2026-27890", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27890", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-17T18:50:13.916401Z", "version": "2.0.3"}}]}, "published": "2026-04-17T19:16:34.993", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-6crx-4g37-7j49"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "firebird", "source": "cna", "vendor": "FirebirdSQL"}, "product": "firebird", "vendor": "firebirdsql"}], "analysis": {"en": {"generated_at": "2026-04-18T09:11:47.687745+00:00", "value": {"mitigation_remediation": ["Upgrade the Firebird server to at least version 5.0.4, 4.0.7, or 3.0.14, which contain the patch that corrects the out\u2013of\u2013order segment handling.", "After upgrading, stop and restart the Firebird service so the new code is loaded.", "If upgrading cannot be performed immediately, restrict access to the Firebird port by firewall or network segmentation to prevent unauthenticated connections until the software is updated."], "summary": {"action": "Patch", "impact": "Denial of Service (unprivileged crash)"}, "threat_synthesis": {"affected_systems": "All FirebirdSQL Firebird database servers running any of the following releases before 5.0.4, before 4.0.7, or before 3.0.14 are affected. These include the 5.x, 4.x, and 3.x branches of Firebird.", "description_and_impact": "Firebird versions prior to 5.0.4, 4.0.7, and 3.0.14 assume that CNCT_specific_data segments arrive in strict ascending order during authentication. When these segments are received out of order, the Array class\u2019s grow() method computes a negative size, resulting in a segmentation fault that crashes the server. This buffer and size overflow flaw (CWE-119, CWE-787) allows an attacker who only knows the server\u2019s IP and port to cause an unauthenticated denial of service by repeatedly triggering the crash.", "risk_and_exploitability": "The CVSS score of 8.2 classifies the flaw as high severity, and the EPSS score is not available. The flaw is not listed in CISA KEV. Because the attack requires only knowledge of the server\u2019s IP and port and does not need authentication, the potential for exploitation remains high. An unauthenticated attacker can repeatedly reset the database service, creating a significant availability risk for services that depend on Firebird. The lack of a current KEV listing suggests no widespread public exploitation yet, but the high CVSS and ease of exploit warrant swift remediation."}}}}, "created": "2026-04-17T19:30:15.491252+00:00", "updated": "2026-04-18T09:15:15.970293+00:00", "vendors": ["firebirdsql", "firebirdsql$PRODUCT$firebird"]}