CVE-2026-35215

{
  "id": "CVE-2026-35215",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-17T20:16:35.240",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does not validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor is later used to calculate the number of slice items, causing a division by zero. An unauthenticated attacker can exploit this by sending a crafted slice packet to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14."
    },
    {
      "lang": "es",
      "value": "Firebird es un sistema de gestión de bases de datos relacionales de código abierto. En versiones anteriores a la 5.0.4, 4.0.7 y 3.0.14, la función sdl_desc() no valida la longitud de un descriptor SDL decodificado de un paquete de segmento. Un descriptor de longitud cero se utiliza posteriormente para calcular el número de elementos de segmento, causando una división por cero. Un atacante no autenticado puede explotar esto enviando un paquete de segmento manipulado para bloquear el servidor. Este problema ha sido solucionado en las versiones 5.0.4, 4.0.7 y 3.0.14."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "FirebirdSQL",
          "product": "firebird",
          "versions": [
            {
              "version": ">= 3.0.0, < 3.0.14",
              "status": "affected"
            },
            {
              "version": ">= 4.0.0, < 4.0.7",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0, < 5.0.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T15:40:04.996968Z",
          "id": "CVE-2026-35215",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-369"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.0.0",
              "versionEndExcluding": "3.0.14",
              "matchCriteriaId": "9A79C5C5-09BC-4F38-8B00-F643818CC87D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.0.7",
              "matchCriteriaId": "A4BC24D2-FBF7-4308-9914-6079DBDF88FA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.0.0",
              "versionEndExcluding": "5.0.4",
              "matchCriteriaId": "938978A3-90BE-4223-BDFC-5310A7C78D9B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-g99w-prq5-29c6",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}