CVE-2026-34232: Firebird: DoS via `op_response` packet from client
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdrstatusvector() function does not handle the iscargcstring type when decoding an opresponse packet, causing a server crash when one is encountered in the status vector. An unauthenticated attacker can exploit this by sending a crafted opresponse packet to the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34232?
CVE-2026-34232 is classified as a denial-of-service (DoS) vulnerability that may result in server crashes.
How do I fix CVE-2026-34232?
To fix CVE-2026-34232, upgrade to Firebird versions 5.0.4, 4.0.7, or 3.0.14 or later.
What versions of Firebird are affected by CVE-2026-34232?
CVE-2026-34232 affects Firebird versions prior to 5.0.4, 4.0.7, and 3.0.14.
What is the cause of the vulnerability in CVE-2026-34232?
The vulnerability in CVE-2026-34232 is due to the xdr_status_vector() function not handling the isc_arg_cstring type properly when decoding an op_response packet.
Can CVE-2026-34232 be exploited remotely?
Yes, CVE-2026-34232 can be exploited remotely via specially crafted op_response packets sent from a client to the server.