{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28214", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T15:28:40.649Z", "datePublished": "2026-04-17T18:35:46.974Z", "dateUpdated": "2026-04-20T13:46:08.635Z"}, "containers": {"cna": {"title": "Firebird server hangs when using specific clumplet on batch creation", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-835", "lang": "en", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "baseScore": 6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7cq5-994r-jhrf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7cq5-994r-jhrf"}, {"name": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14"}, {"name": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7"}, {"name": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4"}], "affected": [{"vendor": "FirebirdSQL", "product": "firebird", "versions": [{"version": ">= 3.0.0, < 3.0.14", "status": "affected"}, {"version": ">= 4.0.0, < 4.0.7", "status": "affected"}, {"version": ">= 5.0.0, < 5.0.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T18:35:46.974Z"}, "descriptions": [{"lang": "en", "value": "Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14."}], "source": {"advisory": "GHSA-7cq5-994r-jhrf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28214", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T13:41:09.298737Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:46:08.635Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28214", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T13:41:09.298737Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:45:03.638Z"}}], "cna": {"title": "Firebird server hangs when using specific clumplet on batch creation", "source": {"advisory": "GHSA-7cq5-994r-jhrf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "FirebirdSQL", "product": "firebird", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.0.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.7"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.4"}]}], "references": [{"url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7cq5-994r-jhrf", "name": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7cq5-994r-jhrf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14", "name": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7", "name": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4", "name": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T18:35:46.974Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28214", "state": "PUBLISHED", "dateUpdated": "2026-04-20T13:46:08.635Z", "dateReserved": "2026-02-25T15:28:40.649Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T18:35:46.974Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "matchCriteriaId": "53D811A2-F880-46E9-9F7F-1CE3AC487F67", "versionEndExcluding": "3.0.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4BC24D2-FBF7-4308-9914-6079DBDF88FA", "versionEndExcluding": "4.0.7", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "matchCriteriaId": "938978A3-90BE-4223-BDFC-5310A7C78D9B", "versionEndExcluding": "5.0.4", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14."}], "id": "CVE-2026-28214", "lastModified": "2026-04-24T19:47:36.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-17T19:16:35.327", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7cq5-994r-jhrf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-835"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "firebird", "source": "cna", "vendor": "FirebirdSQL"}, "product": "firebird", "vendor": "firebirdsql"}], "analysis": {"en": {"generated_at": "2026-04-18T17:11:46.456160+00:00", "value": {"mitigation_remediation": ["Upgrade any Firebird installation to at least version 3.0.14, 4.0.7, or 5.0.4, which contain the fix for the clumplet parsing overflow.", "If an immediate upgrade is not possible, restrict INSERT privileges on tables that accept batch operations and audit all batch insert scripts to ensure they do not include malicious Batch Parameter Blocks.", "Configure your environment to automatically detect servers hanging during batch creation and trigger a service restart, and monitor logs for repeated incidents."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability is present in FirebirdSQL Firebird for all releases prior to 5.0.4, 4.0.7, and 3.0.14. Versions 5.0.4, 4.0.7, and 3.0.14 contain the fix and are not affected.", "description_and_impact": "The ClumpletReader::getClumpletSize() function in Firebird 5.0 and earlier can overflow the totalLength value when parsing a Wide type clumplet, which leads to an infinite loop in the server\u2019s batch creation process. An attacker with INSERT privileges on any table can construct a malicious Batch Parameter Block that triggers this overflow, causing the server to hang and denying service to legitimate users. The weakness is an integer overflow (CWE-190) that results in an unbounded loop (CWE-835).", "risk_and_exploitability": "The CVSS score of 6 indicates medium severity. There is no EPSS data, and the issue is not listed in the KEV catalog. Exploitation requires an authenticated user with INSERT authority, so the attack vector is likely internal. While the vulnerability does not allow arbitrary code execution or data exfiltration, the ability to cause a server hang can disrupt business operations, especially in high\u2011traffic environments."}}}}, "created": "2026-04-17T21:00:12.243215+00:00", "updated": "2026-04-18T17:15:05.784802+00:00", "vendors": ["firebirdsql", "firebirdsql$PRODUCT$firebird"]}