An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions…

CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL

CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL

Bulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST

Description:

Babelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/.

Babelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code.

We identified two issues in the Babelfish TDS protocol layer:

• CVE-2026-119923: A memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process.
• CVE-2026-119924: AA memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service.

Impacted versions:

• Babelfish for PostgreSQL: - 1.0-1.5 - 2.1-2.15 - 3.1-3.12 - 4.0-4.8 - 5.1-5.4
• Babelfish for Aurora PostgreSQL: - 1.x: <1.5.5; >=1.6.0 AND <1.17.2 - 2.x: <2.3.5; >=2.4.0 AND <2.12.4; >=2.13.0 AND <2.13.3; >=2.14.0 AND <2.14.2; >=2.15.0 AND <2.15.2; >=2.16.0 AND <2.16.1 - 3.x: <3.8.4; >=3.9.0 AND <3.9.4; >=3.10.0 AND <3.10.3; >=3.11.0 AND <3.11.2; >=3.12.0 AND <3.12.2; >=3.13.0 AND <3.13.1 - 4.x: <<4.5.5; >=4.6.0 AND <4.6.3; >=4.7.0 AND <4.7.2; >=4.8.0 AND <4.8.2; >=4.9.0 AND <4.9.1 - 5.x: <5.1.4; >=5.2.0 AND <5.2.3; >=5.3.0 AND <5.3.2; >=5.4.0 AND <5.4.2; 5.5.0 - 6.x: >=6.0.0 AND <6.0.2