CVE-2026-34232 Firebird: DoS via `op_response` packet from client

What is CVE-2026-34232?

CVE-2026-34232 is a high-severity denial of service vulnerability in FirebirdSQL firebird, published on 17 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdr_status_vector() function does not handle the isc_arg_cstring type when decoding an op_response packet, causing a server crash when one is encountered in the status vector. An unauthenticated attacker can exploit this by sending a crafted op_response packet to the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Weakness: CWE-228

Which versions are affected by CVE-2026-34232?

It affects 1 product.

Products include Firebirdsql Firebird.

How do I fix CVE-2026-34232?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-34232 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34232 exists.

Other vulnerabilities in FirebirdSQL firebird

• CVE-2026-40342 Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution Critical 10.0
• CVE-2008-0467 Memory corruption in n/a Critical 10.0
• CVE-2007-4992 Memory corruption in n/a Critical 10.0
• CVE-2007-5245 Memory corruption in n/a Critical 10.0
• CVE-2007-5246 Memory corruption in n/a Critical 10.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-34232, ECHO-b431-1233-2fe4, GHSA-7jq3-6j3c-5cm2, UBUNTU-CVE-2026-34232.