{"id":"CVE-2026-119923","kind":"vulnerability","aliases":["CVE-2026-119923"],"related":[],"title":"A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5,…","description":"CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\n### CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\nBulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nBabelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code.\n\nWe identified two issues in the Babelfish TDS protocol layer:\n\n- CVE-2026-119923: A memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process.\n- CVE-2026-119924: AA memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service.\n\nImpacted versions:\n\n- Babelfish for PostgreSQL: - 1.0-1.5 - 2.1-2.15 - 3.1-3.12 - 4.0-4.8 - 5.1-5.4 \n- Babelfish for Aurora PostgreSQL: - 1.x: <1.5.5; >=1.6.0 AND <1.17.2 - 2.x: <2.3.5; >=2.4.0 AND <2.12.4; >=2.13.0 AND <2.13.3; >=2.14.0 AND <2.14.2; >=2.15.0 AND <2.15.2; >=2.16.0 AND <2.16.1 - 3.x: <3.8.4; >=3.9.0 AND <3.9.4; >=3.10.0 AND <3.10.3; >=3.11.0 AND <3.11.2; >=3.12.0 AND <3.12.2; >=3.13.0 AND <3.13.1 - 4.x: <<4.5.5; >=4.6.0 AND <4.6.3; >=4.7.0 AND <4.7.2; >=4.8.0 AND <4.8.2; >=4.9.0 AND <4.9.1 - 5.x: <5.1.4; >=5.2.0 AND <5.2.3; >=5.3.0 AND <5.3.2; >=5.4.0 AND <5.4.2; 5.5.0 - 6.x: >=6.0.0 AND <6.0.2\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1. For Amazon Aurora PostgreSQL customers with Babelfish enabled, upgrade your cluster to one of the following Aurora PostgreSQL versions (included Babelfish version in parentheses) or later, and apply any pending maintenance to ensure you are on the latest patch: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0).\n\nWorkarounds:\n\nRestrict network access to the TDS port (default 1433) to trusted sources using VPC security groups until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-119923\n- CVE-2026-119924\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"AWS bulletin 2026-166-AWS: CVE-2026-119923 is a memory-safety bug in Babelfish TDS connection-handshake handling that a remote, unauthenticated actor could use to affect confidentiality, integrity and availability of the database process. CVE-2026-119924 is a memory-safety bug in TDS RPC request handling that a remote, authenticated actor could use to read adjacent process memory or cause denial of service. AWS gives no CVSS score and does not say either is exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Babelfish for Aurora PostgreSQL","fixed":["1.5.5","1.17.2","2.3.5","2.12.4","2.13.3","2.14.2","2.15.2","2.16.1","3.8.4","3.9.4","3.10.3","3.11.2","3.12.2","3.13.1","4.5.5","4.6.3","4.7.2","4.8.2","4.9.1","5.1.4","5.2.3","5.3.2","5.4.2","5.5.1","6.0.2"],"affected":"1.x <1.5.5, 1.6.0-<1.17.2; 2.x <2.3.5 and gaps below 2.12.4/2.13.3/2.14.2/2.15.2/2.16.1; 3.x <3.8.4 and gaps below 3.9.4/3.10.3/3.11.2/3.12.2/3.13.1; 4.x <4.5.5 and below 4.6.3/4.7.2/4.8.2/4.9.1; 5.x <5.1.4, below 5.2.3/5.3.2/5.4.2, 5.5.0; 6.0.x <6.0.2","ecosystem":"vendor"},{"name":"Babelfish for PostgreSQL extension","fixed":["4.10","5.6","6.1"],"affected":"1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aurora-postgresql","aws","babelfish","databases","infrastructure","lab-disclosure","tds","unauthenticated"],"not_affected_if":["babelfish-disabled","patched-version","tds-port-restricted"],"how_to_check":"Only clusters with Babelfish enabled are affected. Find your Aurora PostgreSQL engine version and its included Babelfish version, then compare against the bulletin ranges (e.g. Aurora Babelfish 1.x <1.5.5 or 1.6.0-1.17.1; 2.x <2.3.5; 3.x <3.8.4; 4.x <4.5.5; 5.x <5.1.4; 6.0.x <6.0.2). Also check whether TDS port 1433 is reachable from untrusted networks in VPC security groups. Workaround until upgraded (per AWS): restrict TDS port 1433 to trusted sources with VPC security groups.","fix":"Upgrade Aurora PostgreSQL to a fixed version (Babelfish version in parentheses) or later and apply pending maintenance: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0). Open-source Babelfish for PostgreSQL: 4.10, 5.6, 6.1.","status":"open","published_at":"2026-11-06T19:17:39+00:00","first_seen_at":"2026-11-06T19:24:10+00:00","triaged_at":"2026-11-06T19:25:14+00:00","updated_at":"2026-11-06T19:43:48+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-06T19:25:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Aurora PostgreSQL clusters with Babelfish enabled to a fixed release, for example `13.9.16` (Babelfish `1.5.5`), `14.20.5` (Babelfish `2.15.2`), `16.14.1` (Babelfish `4.10.0`), `17.10.1` (Babelfish `5.6.0`) or `18.4.1` (Babelfish `6.1.0`), or any later release.\n- Apply pending maintenance to stay on the latest patch.\n- Until the upgrade is applied, restrict access to the TDS port `1433` to trusted sources using VPC security groups (AWS workaround).","reach":"network","title":"Babelfish for Aurora PostgreSQL: TDS handshake memory flaw reachable remotely","impact":"high","summary":"AWS reports a memory-safety bug in the Babelfish TDS connection handshake that lets a remote, unauthenticated client affect the database process. A second bug in RPC request handling lets an authenticated client read nearby process memory or crash the service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["aurora-postgresql","babelfish","aws","databases"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote client may affect the database process; authenticated client reads memory","analyst_note":"Sources do not give CVSS or exploitation status; check the AWS bulletin at https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/ for scores and whether CVE-2026-119923 needs authentication.","how_to_check":"- Check whether Babelfish is enabled on your Aurora PostgreSQL cluster and which Babelfish version it runs (the included Babelfish version is listed in the AWS bulletin).\n- Compare that Babelfish version against the affected ranges in the bulletin, for example `1.5.5`, `2.3.5`, `3.8.4` or `4.5.5`.\n- Check whether the TDS port (default `1433`) is reachable from untrusted networks in your VPC security groups.","plain_action":"","needs_analyst":true,"not_affected_if":["babelfish-disabled","tds-port-restricted","patched-version"],"who_is_affected":"Only Aurora PostgreSQL clusters with Babelfish enabled are affected, because Babelfish adds the SQL Server wire protocol (TDS) that these bugs sit in. The handshake bug can be reached by a remote client without credentials, so exposed TDS ports matter most; the RPC bug needs a valid login. Clusters without Babelfish, or with the TDS port closed to untrusted networks, are lower risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001068,"input_tokens":5843,"output_tokens":967,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Sources do not give CVSS or exploitation status; check the AWS bulletin at https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/ for scores and whether CVE-2026-119923 needs authentication.","search":"'-1.5':20A,325C '-119923':23A,26A,54B,130C,143C,255C,553C '-119924':87B,134C,147C,287C,556C '-166':50B,157C '-2.15':327C '-2026':22A,25A,53B,86B,129C,133C,142C,146C,254C,286C,552C,555C '-3.12':329C '-4.8':331C '-5.4':333C '/babelfish-for-postgresql/babelfish_extensions/.':211C '00':170C '1':338C '1.0':19A,324C '1.17.2':343C,471C '1.5.5':340C,469C '1.6.0':341C '10':169C '11/06/2026':168C '13.23.3':470C '13.9.16':468C '14.17.8':474C '14.18.6':476C '14.19.5':478C '14.20.5':480C '14.22.3':482C '14.23.1':484C '14.6.16':472C '1433':537C '15.10.8':486C '15.12.8':488C '15.13.6':490C '15.14.5':492C '15.15.5':494C '15.17.3':496C '15.18.1':498C '16.10.5':504C '16.11.5':506C '16.13.3':508C '16.14.1':510C '16.8.8':500C '16.9.6':502C '17.10.1':522C '17.4.8':512C '17.5.6':514C '17.6.5':516C '17.7.5':518C '17.9.3':520C '18.3.4':524C '18.4.1':526C '2':344C '2.1':326C '2.12.4':349C,475C '2.13.0':350C '2.13.3':352C,477C '2.14.0':353C '2.14.2':355C,479C '2.15.0':356C '2.15.2':358C,481C '2.16.0':359C '2.16.1':361C,483C '2.17.0':485C '2.3.5':346C,473C '2.4.0':347C '2026':49B,156C '3':362C '3.1':328C '3.10.0':368C '3.10.3':370C,491C '3.11.0':371C '3.11.2':373C,493C '3.12.0':374C '3.12.2':376C,495C '3.13.0':377C '3.13.1':379C,497C '3.14.0':499C '3.8.4':364C,487C '3.9.0':365C '3.9.4':367C,489C '4':380C '4.0':330C '4.10':425C '4.10.0':511C '4.5.5':382C,501C '4.6.0':383C '4.6.3':385C,503C '4.7.0':386C '4.7.2':388C,505C '4.8.0':389C '4.8.2':391C,507C '4.9.0':392C '4.9.1':394C,509C '5':395C '5.1':332C '5.1.4':397C,513C '5.2.0':398C '5.2.3':400C,515C '5.3.0':401C '5.3.2':403C,517C '5.4.0':404C '5.4.2':406C,519C '5.5.0':407C '5.5.1':521C '5.6':426C '5.6.0':523C '6':408C '6.0.0':410C '6.0.2':412C,525C '6.1':428C '6.1.0':527C 'aa':288C 'access':531C 'actor':72B,103B,273C,307C 'address':418C 'adjac':108B,310C 'affect':76B,275C 'allow':228C,269C,303C 'amazon':217C,430C 'appli':456C,549C 'applic':188C,229C,241C 'attent':165C 'aurora':29A,36B,139C,152C,214C,218C,336C,431C,445C 'aurora-postgresql':35B 'authent':102B,306C 'avail':80B,280C 'aw':38B,47B,51B,116B,158C,160C,208C 'aws-security@amazon.com':559C 'babelfish':14A,27A,31A,39B,62B,137C,150C,174C,189C,212C,249C,321C,334C,420C,435C,449C 'base':4A 'buffer':5A 'bug':60B,93B 'built':230C 'bulletin':48B,154C 'call':299C 'caus':112B,314C 'chang':237C 'cluster':439C 'code':242C 'concern':565C 'confidenti':77B,277C 'connect':65B,235C,265C 'connection-handshak':64B,264C 'content':161C 'could':73B,104B,268C,302C 'custom':433C 'cve':21A,24A,52B,85B,128C,132C,141C,145C,253C,285C,551C,554C 'cvss':119B 'databas':40B,83B,283C 'date':167C 'default':536C 'denial':113B,316C 'descript':173C 'develop':191C 'disclosur':44B 'driver':238C 'either':125B 'email':558C 'enabl':178C,216C,436C 'ensur':461C 'exploit':127B 'extens':17A,177C,200C,423C 'extension':34A 'follow':444C 'for':28A,32A 'github.com':210C 'github.com/babelfish-for-postgresql/babelfish_extensions/.':209C 'give':117B 'group':544C 'handl':67B,98B,267C,301C 'handshak':66B,266C 'heap':3A 'heap-bas':2A 'id':155C 'identifi':244C 'impact':319C 'import':163C 'includ':448C 'infrastructur':41B 'integr':78B,278C 'issu':135C,148C,246C,260C,292C,415C 'lab':43B 'lab-disclosur':42B 'later':454C 'latest':466C 'layer':252C 'maintain':206C 'mainten':459C 'memori':58B,91B,110B,258C,290C,312C 'memory-safeti':57B,90B,257C,289C 'model':201C 'modifi':186C 'network':530C 'one':441C 'opensourc':194C 'overflow':6A 'own':204C 'parenthes':452C 'parser':11A 'patch':467C 'pend':458C 'pleas':557C 'port':535C 'postgresql':16A,30A,33A,37B,140C,153C,176C,198C,215C,219C,323C,337C,422C,432C,446C 'prelogin':10A 'procedur':298C 'process':84B,109B,284C,311C 'project':195C 'protocol':226C,251C 'pst':172C 'public':166C 'question':563C 'read':107B,309C 'refer':550C 'remot':70B,101B,271C,297C,305C 'remote-procedure-cal':296C 'request':97B,300C 'requir':164C 'resolut':413C 'restrict':529C 'rewrit':240C 'rpc':96B 'run':181C 'safeti':59B,92B,259C,291C 'say':124B 'scope':159C 'score':120B 'secur':543C,562C 'server':183C,224C,233C 'servic':115B,318C 'sourc':540C 'sql':182C,223C,232C 'tds':9A,45B,63B,95B,227C,250C,263C,295C,534C 'trust':539C 'two':245C 'type':162C 'unauthent':46B,71B,272C 'understand':221C 'upgrad':437C,547C 'use':74B,105B,196C,541C 'user':179C 'version':18A,320C,424C,447C,450C 'vpc':542C 'wire':225C 'without':185C,236C 'workaround':528C 'workload':184C 'x':339C,345C,363C,381C,396C,409C","nicknames":[],"mitigations":[],"who_affected":"Only Aurora PostgreSQL clusters with Babelfish enabled are affected, because Babelfish adds the SQL Server wire protocol (TDS) that these bugs sit in. The handshake bug can be reached by a remote client without credentials, so exposed TDS ports matter most; the RPC bug needs a valid login. Clusters without Babelfish, or with the TDS port closed to untrusted networks, are lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-06T19:26:16Z","by":"analyst","doc":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","run_id":1921},"products":{"at":"2026-11-06T19:26:16Z","by":"analyst","doc":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","run_id":1921},"workarounds":{"at":"2026-11-06T19:26:16Z","by":"analyst","doc":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","run_id":1921},"how_to_check":{"at":"2026-11-06T19:26:16Z","by":"analyst","doc":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","run_id":1921},"who_affected":{"at":"2026-11-06T19:26:16Z","by":"analyst","doc":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","run_id":1921}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["babelfishforaurorapostgresql","babelfishforpostgresqlextension","foraurorapostgresql","forpostgresqlextension"],"ptokens":["aurora","babelfish","extension","for","postgresql"],"labels":["aurorapostgresql","aws","babelfish","critical","databases","infrastructure","labdisclosure","tds","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-1.5':20A '-119923':23A,26A '-2026':22A,25A '1.0':19A 'aurora':29A 'babelfish':14A,27A,31A 'base':4A 'buffer':5A 'cve':21A,24A 'extens':17A 'extension':34A 'for':28A,32A 'heap':3A 'heap-bas':2A 'overflow':6A 'parser':11A 'postgresql':16A,30A,33A 'prelogin':10A 'tds':9A 'version':18A","search_b":"'-119923':54B '-119924':87B '-166':50B '-2026':53B,86B '2026':49B 'actor':72B,103B 'adjac':108B 'affect':76B 'aurora':36B 'aurora-postgresql':35B 'authent':102B 'avail':80B 'aw':38B,47B,51B,116B 'babelfish':39B,62B 'bug':60B,93B 'bulletin':48B 'caus':112B 'confidenti':77B 'connect':65B 'connection-handshak':64B 'could':73B,104B 'cve':52B,85B 'cvss':119B 'databas':40B,83B 'denial':113B 'disclosur':44B 'either':125B 'exploit':127B 'give':117B 'handl':67B,98B 'handshak':66B 'infrastructur':41B 'integr':78B 'lab':43B 'lab-disclosur':42B 'memori':58B,91B,110B 'memory-safeti':57B,90B 'postgresql':37B 'process':84B,109B 'read':107B 'remot':70B,101B 'request':97B 'rpc':96B 'safeti':59B,92B 'say':124B 'score':120B 'servic':115B 'tds':45B,63B,95B 'unauthent':46B,71B 'use':74B,105B","search_c":"'-1.5':325C '-119923':130C,143C,255C,553C '-119924':134C,147C,287C,556C '-166':157C '-2.15':327C '-2026':129C,133C,142C,146C,254C,286C,552C,555C '-3.12':329C '-4.8':331C '-5.4':333C '/babelfish-for-postgresql/babelfish_extensions/.':211C '00':170C '1':338C '1.0':324C '1.17.2':343C,471C '1.5.5':340C,469C '1.6.0':341C '10':169C '11/06/2026':168C '13.23.3':470C '13.9.16':468C '14.17.8':474C '14.18.6':476C '14.19.5':478C '14.20.5':480C '14.22.3':482C '14.23.1':484C '14.6.16':472C '1433':537C '15.10.8':486C '15.12.8':488C '15.13.6':490C '15.14.5':492C '15.15.5':494C '15.17.3':496C '15.18.1':498C '16.10.5':504C '16.11.5':506C '16.13.3':508C '16.14.1':510C '16.8.8':500C '16.9.6':502C '17.10.1':522C '17.4.8':512C '17.5.6':514C '17.6.5':516C '17.7.5':518C '17.9.3':520C '18.3.4':524C '18.4.1':526C '2':344C '2.1':326C '2.12.4':349C,475C '2.13.0':350C '2.13.3':352C,477C '2.14.0':353C '2.14.2':355C,479C '2.15.0':356C '2.15.2':358C,481C '2.16.0':359C '2.16.1':361C,483C '2.17.0':485C '2.3.5':346C,473C '2.4.0':347C '2026':156C '3':362C '3.1':328C '3.10.0':368C '3.10.3':370C,491C '3.11.0':371C '3.11.2':373C,493C '3.12.0':374C '3.12.2':376C,495C '3.13.0':377C '3.13.1':379C,497C '3.14.0':499C '3.8.4':364C,487C '3.9.0':365C '3.9.4':367C,489C '4':380C '4.0':330C '4.10':425C '4.10.0':511C '4.5.5':382C,501C '4.6.0':383C '4.6.3':385C,503C '4.7.0':386C '4.7.2':388C,505C '4.8.0':389C '4.8.2':391C,507C '4.9.0':392C '4.9.1':394C,509C '5':395C '5.1':332C '5.1.4':397C,513C '5.2.0':398C '5.2.3':400C,515C '5.3.0':401C '5.3.2':403C,517C '5.4.0':404C '5.4.2':406C,519C '5.5.0':407C '5.5.1':521C '5.6':426C '5.6.0':523C '6':408C '6.0.0':410C '6.0.2':412C,525C '6.1':428C '6.1.0':527C 'aa':288C 'access':531C 'actor':273C,307C 'address':418C 'adjac':310C 'affect':275C 'allow':228C,269C,303C 'amazon':217C,430C 'appli':456C,549C 'applic':188C,229C,241C 'attent':165C 'aurora':139C,152C,214C,218C,336C,431C,445C 'authent':306C 'avail':280C 'aw':158C,160C,208C 'aws-security@amazon.com':559C 'babelfish':137C,150C,174C,189C,212C,249C,321C,334C,420C,435C,449C 'built':230C 'bulletin':154C 'call':299C 'caus':314C 'chang':237C 'cluster':439C 'code':242C 'concern':565C 'confidenti':277C 'connect':235C,265C 'connection-handshak':264C 'content':161C 'could':268C,302C 'custom':433C 'cve':128C,132C,141C,145C,253C,285C,551C,554C 'databas':283C 'date':167C 'default':536C 'denial':316C 'descript':173C 'develop':191C 'driver':238C 'email':558C 'enabl':178C,216C,436C 'ensur':461C 'extens':177C,200C,423C 'follow':444C 'github.com':210C 'github.com/babelfish-for-postgresql/babelfish_extensions/.':209C 'group':544C 'handl':267C,301C 'handshak':266C 'id':155C 'identifi':244C 'impact':319C 'import':163C 'includ':448C 'integr':278C 'issu':135C,148C,246C,260C,292C,415C 'later':454C 'latest':466C 'layer':252C 'maintain':206C 'mainten':459C 'memori':258C,290C,312C 'memory-safeti':257C,289C 'model':201C 'modifi':186C 'network':530C 'one':441C 'opensourc':194C 'own':204C 'parenthes':452C 'patch':467C 'pend':458C 'pleas':557C 'port':535C 'postgresql':140C,153C,176C,198C,215C,219C,323C,337C,422C,432C,446C 'procedur':298C 'process':284C,311C 'project':195C 'protocol':226C,251C 'pst':172C 'public':166C 'question':563C 'read':309C 'refer':550C 'remot':271C,297C,305C 'remote-procedure-cal':296C 'request':300C 'requir':164C 'resolut':413C 'restrict':529C 'rewrit':240C 'run':181C 'safeti':259C,291C 'scope':159C 'secur':543C,562C 'server':183C,224C,233C 'servic':318C 'sourc':540C 'sql':182C,223C,232C 'tds':227C,250C,263C,295C,534C 'trust':539C 'two':245C 'type':162C 'unauthent':272C 'understand':221C 'upgrad':437C,547C 'use':196C,541C 'user':179C 'version':320C,424C,447C,450C 'vpc':542C 'wire':225C 'without':185C,236C 'workaround':528C 'workload':184C 'x':339C,345C,363C,381C,396C,409C","first_public_at":"2026-11-06T18:46:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/#CVE-2026-119923","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-06T19:24:10+00:00","fetched_at":"2026-11-06T19:24:10+00:00","note":"AWS: CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL"},{"source":"analyst","external_id":"CVE-2026-119923:1921","url":null,"severity":null,"published_at":"2026-11-06T19:26:16+00:00","modified_at":"2026-11-06T19:26:16+00:00","first_seen_at":"2026-11-06T19:26:16+00:00","fetched_at":"2026-11-06T19:26:16+00:00","note":"Read AWS bulletin 2026-166-AWS (primary). No CVSS, exploitation or PoC stated; X not checked. Fix versions and workaround from the bulletin."},{"source":"nvd","external_id":"CVE-2026-119923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119923","severity":null,"published_at":"2026-11-06T19:17:39+00:00","modified_at":"2026-11-06T19:17:39+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","fetched_at":"2026-11-06T19:43:49+00:00","note":null}],"documents":[{"id":89052,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","title":"AWS-2026-166: Issues with Babelfish for Aurora PostgreSQL","kind":"advisory","source":"vendor","publisher":"research","text":"CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\n### CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\nBulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nBabelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code.\n\nWe identified two issues in the Babelfish TDS protocol layer:\n\n- CVE-2026-119923: A memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process.\n- CVE-2026-119924: AA memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service.\n\nImpacted versions:\n\n- Babelfish for PostgreSQL: - 1.0-1.5 - 2.1-2.15 - 3.1-3.12 - 4.0-4.8 - 5.1-5.4 \n- Babelfish for Aurora PostgreSQL: - 1.x: <1.5.5; >=1.6.0 AND <1.17.2 - 2.x: <2.3.5; >=2.4.0 AND <2.12.4; >=2.13.0 AND <2.13.3; >=2.14.0 AND <2.14.2; >=2.15.0 AND <2.15.2; >=2.16.0 AND <2.16.1 - 3.x: <3.8.4; >=3.9.0 AND <3.9.4; >=3.10.0 AND <3.10.3; >=3.11.0 AND <3.11.2; >=3.12.0 AND <3.12.2; >=3.13.0 AND <3.13.1 - 4.x: <<4.5.5; >=4.6.0 AND <4.6.3; >=4.7.0 AND <4.7.2; >=4.8.0 AND <4.8.2; >=4.9.0 AND <4.9.1 - 5.x: <5.1.4; >=5.2.0 AND <5.2.3; >=5.3.0 AND <5.3.2; >=5.4.0 AND <5.4.2; 5.5.0 - 6.x: >=6.0.0 AND <6.0.2\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1. For Amazon Aurora PostgreSQL customers with Babelfish enabled, upgrade your cluster to one of the following Aurora PostgreSQL versions (included Babelfish version in parentheses) or later, and apply any pending maintenance to ensure you are on the latest patch: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0).\n\nWorkarounds:\n\nRestrict network access to the TDS port (default 1433) to trusted sources using VPC security groups until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-119923\n- CVE-2026-119924\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-06T18:46:27+00:00","relation":"mentions","confidence":null,"note":null},{"id":89052,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","title":"AWS-2026-166: Issues with Babelfish for Aurora PostgreSQL","kind":"advisory","source":"vendor","publisher":"research","text":"CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\n### CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\nBulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nBabelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code.\n\nWe identified two issues in the Babelfish TDS protocol layer:\n\n- CVE-2026-119923: A memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process.\n- CVE-2026-119924: AA memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service.\n\nImpacted versions:\n\n- Babelfish for PostgreSQL: - 1.0-1.5 - 2.1-2.15 - 3.1-3.12 - 4.0-4.8 - 5.1-5.4 \n- Babelfish for Aurora PostgreSQL: - 1.x: <1.5.5; >=1.6.0 AND <1.17.2 - 2.x: <2.3.5; >=2.4.0 AND <2.12.4; >=2.13.0 AND <2.13.3; >=2.14.0 AND <2.14.2; >=2.15.0 AND <2.15.2; >=2.16.0 AND <2.16.1 - 3.x: <3.8.4; >=3.9.0 AND <3.9.4; >=3.10.0 AND <3.10.3; >=3.11.0 AND <3.11.2; >=3.12.0 AND <3.12.2; >=3.13.0 AND <3.13.1 - 4.x: <<4.5.5; >=4.6.0 AND <4.6.3; >=4.7.0 AND <4.7.2; >=4.8.0 AND <4.8.2; >=4.9.0 AND <4.9.1 - 5.x: <5.1.4; >=5.2.0 AND <5.2.3; >=5.3.0 AND <5.3.2; >=5.4.0 AND <5.4.2; 5.5.0 - 6.x: >=6.0.0 AND <6.0.2\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1. For Amazon Aurora PostgreSQL customers with Babelfish enabled, upgrade your cluster to one of the following Aurora PostgreSQL versions (included Babelfish version in parentheses) or later, and apply any pending maintenance to ensure you are on the latest patch: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0).\n\nWorkarounds:\n\nRestrict network access to the TDS port (default 1433) to trusted sources using VPC security groups until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-119923\n- CVE-2026-119924\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-06T18:46:27+00:00","relation":"advisory","confidence":null,"note":null},{"id":89052,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","title":"AWS-2026-166: Issues with Babelfish for Aurora PostgreSQL","kind":"advisory","source":"vendor","publisher":"research","text":"CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\n### CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\nBulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nBabelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code.\n\nWe identified two issues in the Babelfish TDS protocol layer:\n\n- CVE-2026-119923: A memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process.\n- CVE-2026-119924: AA memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service.\n\nImpacted versions:\n\n- Babelfish for PostgreSQL: - 1.0-1.5 - 2.1-2.15 - 3.1-3.12 - 4.0-4.8 - 5.1-5.4 \n- Babelfish for Aurora PostgreSQL: - 1.x: <1.5.5; >=1.6.0 AND <1.17.2 - 2.x: <2.3.5; >=2.4.0 AND <2.12.4; >=2.13.0 AND <2.13.3; >=2.14.0 AND <2.14.2; >=2.15.0 AND <2.15.2; >=2.16.0 AND <2.16.1 - 3.x: <3.8.4; >=3.9.0 AND <3.9.4; >=3.10.0 AND <3.10.3; >=3.11.0 AND <3.11.2; >=3.12.0 AND <3.12.2; >=3.13.0 AND <3.13.1 - 4.x: <<4.5.5; >=4.6.0 AND <4.6.3; >=4.7.0 AND <4.7.2; >=4.8.0 AND <4.8.2; >=4.9.0 AND <4.9.1 - 5.x: <5.1.4; >=5.2.0 AND <5.2.3; >=5.3.0 AND <5.3.2; >=5.4.0 AND <5.4.2; 5.5.0 - 6.x: >=6.0.0 AND <6.0.2\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1. For Amazon Aurora PostgreSQL customers with Babelfish enabled, upgrade your cluster to one of the following Aurora PostgreSQL versions (included Babelfish version in parentheses) or later, and apply any pending maintenance to ensure you are on the latest patch: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0).\n\nWorkarounds:\n\nRestrict network access to the TDS port (default 1433) to trusted sources using VPC security groups until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-119923\n- CVE-2026-119924\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-06T18:46:27+00:00","relation":"fix","confidence":null,"note":null},{"id":89335,"url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":89336,"url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60185,"url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}