CVE-2026-35215: Firebird Database DOS Vulnerability

CVE-2026-35215 Overview

CVE-2026-35215 is a Denial of Service vulnerability in Firebird, an open-source relational database management system. The vulnerability exists in the sdl_desc() function which fails to properly validate the length of a decoded SDL (Slice Description Language) descriptor from a slice packet. When a zero-length descriptor is processed, it is subsequently used to calculate the number of slice items, resulting in a division by zero exception that crashes the database server.

Critical Impact

An unauthenticated attacker can remotely crash the Firebird database server by sending a specially crafted slice packet, causing complete service disruption without requiring any authentication.

Affected Products

• Firebird versions prior to 5.0.4
• Firebird versions prior to 4.0.7
• Firebird versions prior to 3.0.14

Discovery Timeline

• 2026-04-17 - CVE-2026-35215 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-35215

Vulnerability Analysis

This vulnerability is classified as CWE-369 (Divide By Zero), a category of input validation errors that can lead to denial of service conditions. The flaw occurs during the processing of SDL descriptors within slice packets, which are used for array operations in Firebird's database engine.

When the sdl_desc() function receives a slice packet containing a malformed SDL descriptor, it decodes the descriptor without validating that the length is non-zero. This unvalidated zero-length value is then passed to a calculation routine that uses it as a divisor to determine the number of slice items. The resulting division by zero triggers an unhandled exception, causing the database server process to terminate abnormally.

The attack can be executed over the network without authentication, making it particularly dangerous for internet-exposed Firebird database instances. The availability impact is severe as the entire database service becomes unavailable until manually restarted.

Root Cause

The root cause is insufficient input validation in the sdl_desc() function. The function processes SDL descriptors from incoming slice packets without verifying that the decoded descriptor length is greater than zero before using it in arithmetic operations. This missing bounds check allows an attacker to supply a crafted packet that passes a zero value to a division operation, triggering an arithmetic exception.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft a malicious slice packet containing a zero-length SDL descriptor and send it directly to a Firebird database server listening on its default port (typically 3050). Upon receiving and processing this packet, the server will encounter the division by zero condition and crash.

The attack does not require any special privileges or prior access to the database. Any network-accessible Firebird instance running a vulnerable version is susceptible. The simplicity of the attack combined with no authentication requirement makes this vulnerability particularly concerning for organizations running Firebird databases exposed to untrusted networks.

Detection Methods for CVE-2026-35215

Indicators of Compromise

• Unexpected Firebird server process crashes or restarts without apparent cause
• Crash dump files indicating division by zero or arithmetic exceptions in the sdl_desc() function
• Unusual network traffic patterns targeting the Firebird port (default 3050) from external sources
• System logs showing repeated service failures for the Firebird database engine

Detection Strategies

• Monitor Firebird server processes for unexpected termination events and abnormal exit codes
• Implement network intrusion detection rules to identify malformed slice packets with zero-length SDL descriptors
• Review application and system logs for division by zero exceptions originating from database components
• Deploy endpoint detection solutions to alert on repeated database service crashes

Monitoring Recommendations

• Enable detailed logging for Firebird database connections and packet processing
• Configure automated alerts for database service availability and unexpected restarts
• Implement network traffic analysis for the Firebird protocol on port 3050
• Establish baseline metrics for normal database operation to detect anomalous crash patterns

How to Mitigate CVE-2026-35215

Immediate Actions Required

• Upgrade Firebird to patched versions: 5.0.4, 4.0.7, or 3.0.14 depending on your deployment branch
• Restrict network access to Firebird database ports using firewall rules to trusted IP addresses only
• Implement network segmentation to isolate database servers from untrusted network segments
• Monitor for service disruptions and implement automatic restart mechanisms as a temporary measure

Patch Information

Firebird has released security patches addressing this vulnerability across all supported version branches. Organizations should upgrade to the appropriate fixed version:

• Firebird 5.x users: Upgrade to version 5.0.4
• Firebird 4.x users: Upgrade to version 4.0.7
• Firebird 3.x users: Upgrade to version 3.0.14

For complete technical details about this vulnerability, refer to the GitHub Security Advisory GHSA-g99w-prq5-29c6.

Workarounds

• Restrict access to Firebird ports at the network perimeter using firewall rules to allow only trusted clients
• Deploy a reverse proxy or application gateway with protocol inspection capabilities to filter malicious packets
• Implement database connection pooling with health checks to automatically detect and recover from crashes
• Consider temporarily disabling network access to Firebird instances if immediate patching is not feasible

# Example firewall configuration to restrict Firebird access (iptables)
# Only allow connections from trusted network segments
iptables -A INPUT -p tcp --dport 3050 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3050 -j DROP