CVE-2021-21704: Multiple vulnerabilities in Firebird client extension

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-10-04 · updated 2026-06-17
Weakness: CWE-125

Description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.

Affected products

Clustered Data ONTAP: all versions
PHP: from 7.3.0 before 7.3.29; from 7.4.0 before 7.4.21; from 8.0.0 before 8.0.8 — fixed in 7.3.29, 7.4.21, 8.0.8

How to fix

Upgrade to a fixed version: PHP 7.3.29, 7.4.21, 8.0.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-21704 or the next vulnerability affects your stack