CVE-2026-28224: Firebird Database DoS Vulnerability

CVE-2026-28224 Overview

CVE-2026-28224 is a Null Pointer Dereference vulnerability affecting Firebird, an open-source relational database management system. When the Firebird server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not properly initialized, resulting in a null pointer dereference and immediate server crash. This vulnerability allows an unauthenticated attacker who knows only the server's IP address and port to remotely crash the database server, causing a denial of service condition.

Critical Impact

Unauthenticated remote attackers can crash Firebird database servers with a single malformed packet, causing complete service disruption without any authentication required.

Affected Products

• Firebird versions prior to 5.0.4
• Firebird versions prior to 4.0.7
• Firebird versions prior to 3.0.14

Discovery Timeline

• April 17, 2026 - CVE-2026-28224 published to NVD
• April 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-28224

Vulnerability Analysis

This vulnerability exists in Firebird's network protocol handling for encrypted communication setup. The Firebird server implements a callback mechanism for cryptographic key exchange via the op_crypt_key_callback operation. Under normal circumstances, this callback handler (port_server_crypt_callback) is initialized during the authentication handshake before any encryption-related operations occur.

The vulnerability arises because the server does not validate that authentication has been completed before processing op_crypt_key_callback packets. When an unauthenticated client sends this packet type directly to the server, the code attempts to invoke the port_server_crypt_callback handler, which remains uninitialized (null). This results in a null pointer dereference, causing the server process to crash immediately.

The attack is trivial to execute—an attacker needs only network access to the Firebird port (typically TCP 3050) and can send the malformed packet without any credentials or prior knowledge of the database structure.

Root Cause

The root cause is improper state validation in the network protocol handler. The server fails to verify that the connection has progressed through the required authentication phase before accepting cryptographic callback packets. This represents a classic CWE-476 (NULL Pointer Dereference) vulnerability where input validation does not ensure prerequisite state conditions are met before accessing handler pointers.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker can exploit this vulnerability by:

1. Establishing a TCP connection to the Firebird server port (default: 3050)
2. Sending a crafted op_crypt_key_callback packet immediately, bypassing authentication
3. The server attempts to dereference the uninitialized port_server_crypt_callback pointer
4. The null pointer dereference causes an immediate server crash

The vulnerability enables a complete denial of service against any exposed Firebird database server. The attack can be repeated indefinitely, preventing the database from maintaining availability even if automatic restart mechanisms are in place.

Detection Methods for CVE-2026-28224

Indicators of Compromise

• Unexpected Firebird server crashes or restarts without corresponding database errors
• Connection attempts to Firebird port (3050) that do not complete authentication
• Server crash dumps showing null pointer dereference in cryptographic callback handling code
• Sudden service termination events in Firebird logs correlating with network connection events

Detection Strategies

• Monitor for repeated Firebird service crashes or automatic restarts in short time windows
• Implement network intrusion detection rules to identify malformed op_crypt_key_callback packets sent before authentication completion
• Configure application-level monitoring to alert on Firebird process termination signals (SIGSEGV, SIGABRT)
• Deploy SentinelOne Singularity to detect abnormal process termination patterns indicative of exploitation

Monitoring Recommendations

• Enable detailed logging on Firebird servers to capture connection state before crashes
• Monitor network traffic to Firebird ports for connections that disconnect immediately after establishing TCP handshake
• Implement availability monitoring with alerts on Firebird service downtime
• Track process crash events on database servers through endpoint detection and response (EDR) solutions

How to Mitigate CVE-2026-28224

Immediate Actions Required

• Upgrade Firebird to patched versions: 5.0.4, 4.0.7, or 3.0.14 depending on your major version branch
• Restrict network access to Firebird database ports using firewall rules to allow only trusted client IP addresses
• Place Firebird servers behind network segmentation that prevents direct external access
• Implement service monitoring and automatic restart to minimize downtime during any exploitation attempts

Patch Information

Firebird has released security patches addressing this vulnerability in the following versions:

For complete details on the vulnerability, refer to the GitHub Security Advisory GHSA-xrcw-wpjx-pr95.

Workarounds

• Apply firewall rules to restrict Firebird port access to only authorized client IP addresses or network ranges
• Deploy a reverse proxy or application-layer gateway that validates connection state before forwarding to Firebird
• Use VPN or SSH tunneling for all remote database connections to prevent direct exposure
• If immediate patching is not possible, consider temporarily disabling external network access to the database server

# Example: Restrict Firebird access using iptables (Linux)
# Only allow connections from trusted network 192.168.1.0/24
iptables -A INPUT -p tcp --dport 3050 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3050 -j DROP