CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2026-28224

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Score
8.2 high
Published
2026-04-17
Links
NVD · cve.org

Affected ports (4)

PortPackageVersionStatusMaintainer
databases/firebird30-clientfirebird30-client3.0.12unaddressedacm@FreeBSD.org
databases/firebird30-serverfirebird30-server3.0.12unaddressedacm@FreeBSD.org
databases/firebird40-clientfirebird40-client4.0.5_2unaddressedacm@FreeBSD.org
databases/firebird40-serverfirebird40-server4.0.5_2unaddressedacm@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>firebird30-client</name>
	<range><lt>3.0.14</lt></range>
      </package>
      <package>
	<name>firebird30-server</name>
	<range><lt>3.0.14</lt></range>
      </package>
      <package>
	<name>firebird40-client</name>
	<range><lt>3.0.14</lt></range>
      </package>
      <package>
	<name>firebird40-server</name>
	<range><lt>3.0.14</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Firebird is an open-source relational database management system. In
	versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an
	op_crypt_key_callback packet without prior authentication, the
	port_server_crypt_callback handler is not initialized, resulting in a
	null pointer dereference and server crash. An unauthenticated attacker
	who knows only the server's IP and port can exploit this to crash the
	server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-28224</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-28224</url>
    </references>
    <dates>
      <discovery>2026-04-17</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>