CVE-2026-28214

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28214.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-190",
        "CWE-835"
    ]
}

References

Affected packages

Git / github.com/firebirdsql/firebird

Affected ranges

Type

GIT

Repo

https://github.com/firebirdsql/firebird

Events

Introduced

1767a517f9c99ec97160cacb452fdcfd83dca9be

Fixed

463bae029a4426deff7e9bb08a8317aaa398c7c7

Introduced

141bb5491d24cb363f03c5a0786a32f73a1faa5b

Fixed

26f6881c9eac77c5e3166d209682c0ebe8dd07c0

Introduced

af1546f15fa871b313ebcc7df1fd2df3c396c616

Fixed

f6d83a28c009ab039ea40ffdb4ccc58f190dfbe6

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.14"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.7"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.4"
        }
    ]
}

Affected versions

Other

R3_0_0

R3_0_1

R3_0_2

R3_0_3

R3_0_4

R3_0_5

R3_0_6

R3_0_7

v3.*

v3.0.10

v3.0.11

v3.0.12

v3.0.13

v3.0.8

v3.0.9

v4.*

v4.0.0

v4.0.1

v4.0.2

v4.0.3

v4.0.4

v4.0.5

v4.0.6

v5.*

v5.0.0

v5.0.1

v5.0.2

v5.0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28214.json"