CVE-2026-27890 Firebird has Pre-Auth DOS when Processing Out of Order CNCT_specific_data Segments
An unauthenticated attacker can crash the Firebird database server by sending out-of-order authentication segments, causing a segmentation fault.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27890?
CVE-2026-27890 is a high-severity denial of service vulnerability in FirebirdSQL firebird, published on 17 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow() method computes a negative size value, causing a SIGSEGV crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Which versions are affected by CVE-2026-27890?
It affects 1 product.
Products include Firebirdsql Firebird.
How do I fix CVE-2026-27890?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-27890 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27890 exists.
Other vulnerabilities in FirebirdSQL firebird
Sources
Also known as DEBIAN-CVE-2026-27890, ECHO-45ec-b367-e096, GHSA-6crx-4g37-7j49, UBUNTU-CVE-2026-27890.