CVE-2026-28214 Firebird server hangs when using specific clumplet on batch creation

What is CVE-2026-28214?

CVE-2026-28214 is a medium-severity vulnerability in FirebirdSQL firebird, published on 17 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Weakness: CWE-835, CWE-190

Which versions are affected by CVE-2026-28214?

It affects 1 product.

Products include Firebirdsql Firebird.

How do I fix CVE-2026-28214?

Upgrade to a fixed version.

Is CVE-2026-28214 being exploited?

There is no known exploitation of CVE-2026-28214 in the wild and no public exploit code.

Other vulnerabilities in FirebirdSQL firebird

• CVE-2026-40342 Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution Critical 10.0
• CVE-2008-0467 Memory corruption in n/a Critical 10.0
• CVE-2007-4992 Memory corruption in n/a Critical 10.0
• CVE-2007-5245 Memory corruption in n/a Critical 10.0
• CVE-2007-5246 Memory corruption in n/a Critical 10.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-28214, ECHO-fb89-2007-348d, GHSA-7cq5-994r-jhrf, UBUNTU-CVE-2026-28214.