CVE-2026-35215

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does not validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor is later used to calculate the number of slice items, causing a division by zero. An unauthenticated attacker can exploit this by sending a crafted slice packet to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

• CWE-369

• https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14Release Notes
• https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7Release Notes
• https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4Release Notes
• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-g99w-prq5-29c6Exploit, Vendor Advisory

Published

Apr 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35209defu is software that allows uers to assign default properti…7.5
• CVE-2026-35210OpenCTI is an open source platform for managing cyber threat…7.1
• CVE-2026-35211OpenCTI is an open source platform for managing cyber threat…6.5
• CVE-2026-35212OpenCTI is an open source platform for managing cyber threat…6.1
• CVE-2026-35213@hapi/content provided HTTP Content-* headers parsing. All v…7.5
• CVE-2026-35214Budibase is an open-source low-code platform. Prior to versi…8.7
• CVE-2026-35216Budibase is an open-source low-code platform. Prior to versi…9
• CVE-2026-35217NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SU…6.5
• CVE-2026-35218Budibase is an open-source low-code platform. Prior to versi…8.7
• CVE-2026-35220Lack of CSRF token validation lead to a CSRF attack vector i…4.3
• CVE-2026-35221Improperly built filter clauses lead to a SQL injection vuln…9.8
• CVE-2026-35222Improperly validated order clauses lead to a SQL injection v…9.8