CVE-2026-28224

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an opcryptkeycallback packet without prior authentication, the portservercryptcallback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28224.json",
    "cwe_ids": [
        "CWE-476"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/firebirdsql/firebird

Affected ranges

Type

GIT

Repo

https://github.com/firebirdsql/firebird

Events

Introduced

1767a517f9c99ec97160cacb452fdcfd83dca9be

Fixed

463bae029a4426deff7e9bb08a8317aaa398c7c7

Introduced

141bb5491d24cb363f03c5a0786a32f73a1faa5b

Fixed

26f6881c9eac77c5e3166d209682c0ebe8dd07c0

Introduced

af1546f15fa871b313ebcc7df1fd2df3c396c616

Fixed

f6d83a28c009ab039ea40ffdb4ccc58f190dfbe6

Database specific

{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.14"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.7"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other

R3_0_0

R3_0_1

R3_0_2

R3_0_3

R3_0_4

R3_0_5

R3_0_6

R3_0_7

v3.*

v3.0.10

v3.0.11

v3.0.12

v3.0.13

v3.0.8

v3.0.9

v4.*

v4.0.0

v4.0.1

v4.0.2

v4.0.3

v4.0.4

v4.0.5

v4.0.6

v5.*

v5.0.0

v5.0.1

v5.0.2

v5.0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28224.json"