{"id":"CVE-2026-119924","kind":"vulnerability","aliases":["CVE-2026-119924"],"related":[],"title":"An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions…","description":"CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\n### CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\nBulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nBabelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code.\n\nWe identified two issues in the Babelfish TDS protocol layer:\n\n- CVE-2026-119923: A memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process.\n- CVE-2026-119924: AA memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service.\n\nImpacted versions:\n\n- Babelfish for PostgreSQL: - 1.0-1.5 - 2.1-2.15 - 3.1-3.12 - 4.0-4.8 - 5.1-5.4 \n- Babelfish for Aurora PostgreSQL: - 1.x: <1.5.5; >=1.6.0 AND <1.17.2 - 2.x: <2.3.5; >=2.4.0 AND <2.12.4; >=2.13.0 AND <2.13.3; >=2.14.0 AND <2.14.2; >=2.15.0 AND <2.15.2; >=2.16.0 AND <2.16.1 - 3.x: <3.8.4; >=3.9.0 AND <3.9.4; >=3.10.0 AND <3.10.3; >=3.11.0 AND <3.11.2; >=3.12.0 AND <3.12.2; >=3.13.0 AND <3.13.1 - 4.x: <<4.5.5; >=4.6.0 AND <4.6.3; >=4.7.0 AND <4.7.2; >=4.8.0 AND <4.8.2; >=4.9.0 AND <4.9.1 - 5.x: <5.1.4; >=5.2.0 AND <5.2.3; >=5.3.0 AND <5.3.2; >=5.4.0 AND <5.4.2; 5.5.0 - 6.x: >=6.0.0 AND <6.0.2\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1. For Amazon Aurora PostgreSQL customers with Babelfish enabled, upgrade your cluster to one of the following Aurora PostgreSQL versions (included Babelfish version in parentheses) or later, and apply any pending maintenance to ensure you are on the latest patch: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0).\n\nWorkarounds:\n\nRestrict network access to the TDS port (default 1433) to trusted sources using VPC security groups until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-119923\n- CVE-2026-119924\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"AWS disclosed two memory-safety flaws in the TDS (SQL Server wire protocol) layer of Babelfish for Aurora PostgreSQL. One, in the connection handshake, could be reached by an unauthenticated remote actor; the other, in RPC request handling, lets an authenticated actor read adjacent process memory or crash the database process.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"babelfish-for-aurora-postgresql","fixed":["1.5.5","1.17.2","2.17.0","3.14.0","4.10.0","5.6.0","6.0.2","6.1.0"],"affected":"1.x <1.5.5, >=1.6.0 <1.17.2; 2.x <2.3.5 etc. (see bulletin); 4.x <4.5.5, >=4.6.0 <4.6.3, >=4.7.0 <4.7.2, >=4.8.0 <4.8.2, >=4.9.0 <4.9.1; 6.x >=6.0.0 <6.0.2","ecosystem":"vendor"},{"name":"babelfish-for-postgresql","fixed":["4.10","5.6","6.1"],"affected":"1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aurora-postgresql","aws","babelfish","infrastructure","lab-disclosure","sql-server-compatibility","tds"],"not_affected_if":["babelfish-disabled","managed-hosting-patched","tds-port-restricted"],"how_to_check":"- Confirm Babelfish is enabled on the Aurora PostgreSQL cluster, then compare the cluster's Babelfish version with the bulletin's ranges (the '<<4.5.5' in the 4.x line is a typo for '<4.5.5': 4.x is affected below 4.5.5, 4.6.x below 4.6.3, 4.7.x below 4.7.2, 4.8.x below 4.8.2, 4.9.x below 4.9.1).\n- Check whether the TDS port (default 1433) is reachable from untrusted networks in VPC security groups.\n- Also check self-managed PostgreSQL running the open-source Babelfish extension: versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 are listed.","fix":"Upgrade the Aurora PostgreSQL cluster to the patched release for your major line (Babelfish version in parentheses), or later, and apply pending maintenance: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0). Open-source Babelfish for PostgreSQL extension: 4.10, 5.6 or 6.1. Until upgraded, AWS says to restrict the TDS port (default 1433) to trusted sources with VPC security groups.","status":"open","published_at":"2026-11-06T19:17:39+00:00","first_seen_at":"2026-11-06T19:24:10+00:00","triaged_at":"2026-11-06T19:25:14+00:00","updated_at":"2026-11-06T19:43:48+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-06T19:25:14Z","model":"claude-haiku-5-5","output":{"fix":"- Babelfish for PostgreSQL extension: `4.10`, `5.6`, `6.1` or later.\n- Aurora PostgreSQL: upgrade to one of the listed versions, for example `13.9.16` (Babelfish `1.5.5`), `14.23.1` (Babelfish `2.17.0`), `15.18.1` (Babelfish `3.14.0`), `18.4.1` (Babelfish `6.1.0`), and apply pending maintenance.\n- Until the upgrade is applied, restrict access to the TDS port to trusted sources using VPC security groups, per the bulletin.","reach":"network","title":"Amazon Aurora PostgreSQL Babelfish: memory-safety flaws in SQL Server protocol handling","impact":"high","summary":"AWS disclosed two memory-safety flaws in the TDS (SQL Server wire protocol) layer of Babelfish for Aurora PostgreSQL. One, in the connection handshake, could be reached by an unauthenticated remote actor; the other, in RPC request handling, lets an authenticated actor read adjacent process memory or crash the database process.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["aws","aurora-postgresql","babelfish","sql-server-compatibility"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker reads process memory or crashes the database","analyst_note":"Confirm the affected-version logic for Babelfish 4.x (the bulletin lists '<<4.5.5' which looks like a typo) and CVSS scores at https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/.","how_to_check":"- Check whether Babelfish is enabled on the Aurora PostgreSQL cluster and note the Babelfish version and Aurora version against the affected ranges in the bulletin.\n- Check whether the TDS port (default `1433`) is reachable from untrusted networks in the VPC security groups.","plain_action":"","needs_analyst":true,"not_affected_if":["babelfish-disabled","managed-hosting-patched","tds-port-restricted"],"who_is_affected":"Aurora PostgreSQL clusters with Babelfish enabled are exposed, in the affected version ranges listed in the bulletin. Clusters without Babelfish, or with the TDS port closed to untrusted networks, are less exposed; the unauthenticated handshake flaw matters most where the port is reachable from the internet or broad networks.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00104,"input_tokens":5843,"output_tokens":912,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the affected-version logic for Babelfish 4.x (the bulletin lists '<<4.5.5' which looks like a typo) and CVSS scores at https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/.","search":"'-1.5':300C '-119923':105C,118C,230C,528C '-119924':24A,27A,109C,122C,262C,531C '-166':132C '-2.15':302C '-2026':23A,26A,104C,108C,117C,121C,229C,261C,527C,530C '-3.12':304C '-4.8':306C '-5.4':308C '/babelfish-for-postgresql/babelfish_extensions/.':186C '00':145C '1':313C '1.0':299C '1.17.2':318C,446C '1.5.5':315C,444C '1.6.0':316C '10':144C '11/06/2026':143C '13.23.3':445C '13.9.16':443C '14.17.8':449C '14.18.6':451C '14.19.5':453C '14.20.5':455C '14.22.3':457C '14.23.1':459C '14.6.16':447C '1433':512C '15.10.8':461C '15.12.8':463C '15.13.6':465C '15.14.5':467C '15.15.5':469C '15.17.3':471C '15.18.1':473C '16.10.5':479C '16.11.5':481C '16.13.3':483C '16.14.1':485C '16.8.8':475C '16.9.6':477C '17.10.1':497C '17.4.8':487C '17.5.6':489C '17.6.5':491C '17.7.5':493C '17.9.3':495C '18.3.4':499C '18.4.1':501C '2':319C '2.1':301C '2.12.4':324C,450C '2.13.0':325C '2.13.3':327C,452C '2.14.0':328C '2.14.2':330C,454C '2.15.0':331C '2.15.2':333C,456C '2.16.0':334C '2.16.1':336C,458C '2.17.0':460C '2.3.5':321C,448C '2.4.0':322C '2026':131C '3':337C '3.1':303C '3.10.0':343C '3.10.3':345C,466C '3.11.0':346C '3.11.2':348C,468C '3.12.0':349C '3.12.2':351C,470C '3.13.0':352C '3.13.1':354C,472C '3.14.0':474C '3.8.4':339C,462C '3.9.0':340C '3.9.4':342C,464C '4':355C '4.0':305C '4.10':400C '4.10.0':486C '4.5.5':357C,476C '4.6.0':358C '4.6.3':360C,478C '4.7.0':361C '4.7.2':363C,480C '4.8.0':364C '4.8.2':366C,482C '4.9.0':367C '4.9.1':369C,484C '5':370C '5.1':307C '5.1.4':372C,488C '5.2.0':373C '5.2.3':375C,490C '5.3.0':376C '5.3.2':378C,492C '5.4.0':379C '5.4.2':381C,494C '5.5.0':382C '5.5.1':496C '5.6':401C '5.6.0':498C '6':383C '6.0.0':385C '6.0.2':387C,500C '6.1':403C '6.1.0':502C 'aa':263C 'access':506C 'actor':83B,93B,248C,282C 'address':393C 'adjac':95B,285C 'affect':250C 'allow':203C,244C,278C 'amazon':192C,405C 'appli':431C,524C 'applic':163C,204C,216C 'attent':140C 'aurora':31A,38B,69B,114C,127C,189C,193C,311C,406C,420C 'aurora-postgresql':37B 'authent':92B,281C 'avail':255C 'aw':40B,51B,133C,135C,183C 'aws-security@amazon.com':534C 'babelfish':17A,29A,34A,41B,67B,112C,125C,149C,164C,187C,224C,296C,309C,395C,410C,424C 'babelfish-for-aurora-postgresql':28A 'babelfish-for-postgresql':33A 'bound':5A 'built':205C 'bulletin':129C 'call':274C 'caus':289C 'chang':212C 'cluster':414C 'code':217C 'compat':49B 'concern':540C 'confidenti':252C 'connect':74B,210C,240C 'connection-handshak':239C 'content':136C 'could':76B,243C,277C 'crash':99B 'custom':408C 'cve':22A,25A,103C,107C,116C,120C,228C,260C,526C,529C 'databas':101B,258C 'date':142C 'default':511C 'denial':291C 'descript':148C 'develop':166C 'disclos':52B 'disclosur':45B 'driver':213C 'email':533C 'enabl':153C,191C,411C 'ensur':436C 'extens':20A,152C,175C,398C 'flaw':57B 'follow':419C 'for':30A,35A 'github.com':185C 'github.com/babelfish-for-postgresql/babelfish_extensions/.':184C 'group':519C 'handl':89B,242C,276C 'handshak':75B,241C 'id':130C 'identifi':219C 'impact':294C 'import':138C 'includ':423C 'infrastructur':42B 'integr':253C 'issu':110C,123C,221C,235C,267C,390C 'lab':44B 'lab-disclosur':43B 'later':429C 'latest':441C 'layer':65B,227C 'let':90B 'maintain':181C 'mainten':434C 'memori':55B,97B,233C,265C,287C 'memory-safeti':54B,232C,264C 'model':176C 'modifi':161C 'name':13A 'network':505C 'one':71B,416C 'opensourc':169C 'out-of-bound':2A 'own':179C 'parenthes':427C 'parser':14A 'patch':442C 'pend':433C 'pleas':532C 'port':510C 'postgresql':19A,32A,36A,39B,70B,115C,128C,151C,173C,190C,194C,298C,312C,397C,407C,421C 'procedur':12A,273C 'procedure-nam':11A 'process':96B,102B,259C,286C 'project':170C 'protocol':64B,201C,226C 'pst':147C 'public':141C 'question':538C 'reach':78B 'read':6A,94B,284C 'refer':525C 'remot':82B,246C,272C,280C 'remote-procedure-cal':271C 'request':88B,275C 'requir':139C 'resolut':388C 'restrict':504C 'rewrit':215C 'rpc':10A,87B 'run':156C 'safeti':56B,234C,266C 'scope':134C 'secur':518C,537C 'server':48B,62B,158C,199C,208C 'servic':293C 'sourc':515C 'sql':47B,61B,157C,198C,207C 'sql-server-compat':46B 'tds':9A,50B,60B,202C,225C,238C,270C,509C 'trust':514C 'two':53B,220C 'type':137C 'unauthent':81B,247C 'understand':196C 'upgrad':412C,522C 'use':171C,516C 'user':154C 'version':21A,295C,399C,422C,425C 'vpc':517C 'wire':63B,200C 'without':160C,211C 'workaround':503C 'workload':159C 'x':314C,320C,338C,356C,371C,384C","nicknames":[],"mitigations":[],"who_affected":"Aurora PostgreSQL clusters with Babelfish enabled (SQL Server wire protocol/TDS) on versions below the patched releases in AWS bulletin 2026-166-AWS, and self-run PostgreSQL with the Babelfish extension in the listed versions. CVE-2026-119923 can be reached by an unauthenticated remote actor in the handshake; CVE-2026-119924 needs authentication (read adjacent memory or crash). Clusters without Babelfish, or with port 1433 restricted to trusted sources, can skip or reduce urgency.","tier":"B","verified":{"fix":{"at":"2026-11-06T19:26:24Z","by":"analyst","doc":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","run_id":1920},"products":{"at":"2026-11-06T19:26:24Z","by":"analyst","doc":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","run_id":1920},"how_to_check":{"at":"2026-11-06T19:26:24Z","by":"analyst","doc":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","run_id":1920},"who_affected":{"at":"2026-11-06T19:26:24Z","by":"analyst","doc":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","run_id":1920}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["babelfishforaurorapostgresql","babelfishforpostgresql"],"ptokens":["aurora","babelfish","for","postgresql"],"labels":["aurorapostgresql","aws","babelfish","high","infrastructure","labdisclosure","sqlservercompatibility","tds","vendor"],"campaign_type":null,"search_a":"'-119924':24A,27A '-2026':23A,26A 'aurora':31A 'babelfish':17A,29A,34A 'babelfish-for-aurora-postgresql':28A 'babelfish-for-postgresql':33A 'bound':5A 'cve':22A,25A 'extens':20A 'for':30A,35A 'name':13A 'out-of-bound':2A 'parser':14A 'postgresql':19A,32A,36A 'procedur':12A 'procedure-nam':11A 'read':6A 'rpc':10A 'tds':9A 'version':21A","search_b":"'actor':83B,93B 'adjac':95B 'aurora':38B,69B 'aurora-postgresql':37B 'authent':92B 'aw':40B,51B 'babelfish':41B,67B 'compat':49B 'connect':74B 'could':76B 'crash':99B 'databas':101B 'disclos':52B 'disclosur':45B 'flaw':57B 'handl':89B 'handshak':75B 'infrastructur':42B 'lab':44B 'lab-disclosur':43B 'layer':65B 'let':90B 'memori':55B,97B 'memory-safeti':54B 'one':71B 'postgresql':39B,70B 'process':96B,102B 'protocol':64B 'reach':78B 'read':94B 'remot':82B 'request':88B 'rpc':87B 'safeti':56B 'server':48B,62B 'sql':47B,61B 'sql-server-compat':46B 'tds':50B,60B 'two':53B 'unauthent':81B 'wire':63B","search_c":"'-1.5':300C '-119923':105C,118C,230C,528C '-119924':109C,122C,262C,531C '-166':132C '-2.15':302C '-2026':104C,108C,117C,121C,229C,261C,527C,530C '-3.12':304C '-4.8':306C '-5.4':308C '/babelfish-for-postgresql/babelfish_extensions/.':186C '00':145C '1':313C '1.0':299C '1.17.2':318C,446C '1.5.5':315C,444C '1.6.0':316C '10':144C '11/06/2026':143C '13.23.3':445C '13.9.16':443C '14.17.8':449C '14.18.6':451C '14.19.5':453C '14.20.5':455C '14.22.3':457C '14.23.1':459C '14.6.16':447C '1433':512C '15.10.8':461C '15.12.8':463C '15.13.6':465C '15.14.5':467C '15.15.5':469C '15.17.3':471C '15.18.1':473C '16.10.5':479C '16.11.5':481C '16.13.3':483C '16.14.1':485C '16.8.8':475C '16.9.6':477C '17.10.1':497C '17.4.8':487C '17.5.6':489C '17.6.5':491C '17.7.5':493C '17.9.3':495C '18.3.4':499C '18.4.1':501C '2':319C '2.1':301C '2.12.4':324C,450C '2.13.0':325C '2.13.3':327C,452C '2.14.0':328C '2.14.2':330C,454C '2.15.0':331C '2.15.2':333C,456C '2.16.0':334C '2.16.1':336C,458C '2.17.0':460C '2.3.5':321C,448C '2.4.0':322C '2026':131C '3':337C '3.1':303C '3.10.0':343C '3.10.3':345C,466C '3.11.0':346C '3.11.2':348C,468C '3.12.0':349C '3.12.2':351C,470C '3.13.0':352C '3.13.1':354C,472C '3.14.0':474C '3.8.4':339C,462C '3.9.0':340C '3.9.4':342C,464C '4':355C '4.0':305C '4.10':400C '4.10.0':486C '4.5.5':357C,476C '4.6.0':358C '4.6.3':360C,478C '4.7.0':361C '4.7.2':363C,480C '4.8.0':364C '4.8.2':366C,482C '4.9.0':367C '4.9.1':369C,484C '5':370C '5.1':307C '5.1.4':372C,488C '5.2.0':373C '5.2.3':375C,490C '5.3.0':376C '5.3.2':378C,492C '5.4.0':379C '5.4.2':381C,494C '5.5.0':382C '5.5.1':496C '5.6':401C '5.6.0':498C '6':383C '6.0.0':385C '6.0.2':387C,500C '6.1':403C '6.1.0':502C 'aa':263C 'access':506C 'actor':248C,282C 'address':393C 'adjac':285C 'affect':250C 'allow':203C,244C,278C 'amazon':192C,405C 'appli':431C,524C 'applic':163C,204C,216C 'attent':140C 'aurora':114C,127C,189C,193C,311C,406C,420C 'authent':281C 'avail':255C 'aw':133C,135C,183C 'aws-security@amazon.com':534C 'babelfish':112C,125C,149C,164C,187C,224C,296C,309C,395C,410C,424C 'built':205C 'bulletin':129C 'call':274C 'caus':289C 'chang':212C 'cluster':414C 'code':217C 'concern':540C 'confidenti':252C 'connect':210C,240C 'connection-handshak':239C 'content':136C 'could':243C,277C 'custom':408C 'cve':103C,107C,116C,120C,228C,260C,526C,529C 'databas':258C 'date':142C 'default':511C 'denial':291C 'descript':148C 'develop':166C 'driver':213C 'email':533C 'enabl':153C,191C,411C 'ensur':436C 'extens':152C,175C,398C 'follow':419C 'github.com':185C 'github.com/babelfish-for-postgresql/babelfish_extensions/.':184C 'group':519C 'handl':242C,276C 'handshak':241C 'id':130C 'identifi':219C 'impact':294C 'import':138C 'includ':423C 'integr':253C 'issu':110C,123C,221C,235C,267C,390C 'later':429C 'latest':441C 'layer':227C 'maintain':181C 'mainten':434C 'memori':233C,265C,287C 'memory-safeti':232C,264C 'model':176C 'modifi':161C 'network':505C 'one':416C 'opensourc':169C 'own':179C 'parenthes':427C 'patch':442C 'pend':433C 'pleas':532C 'port':510C 'postgresql':115C,128C,151C,173C,190C,194C,298C,312C,397C,407C,421C 'procedur':273C 'process':259C,286C 'project':170C 'protocol':201C,226C 'pst':147C 'public':141C 'question':538C 'read':284C 'refer':525C 'remot':246C,272C,280C 'remote-procedure-cal':271C 'request':275C 'requir':139C 'resolut':388C 'restrict':504C 'rewrit':215C 'run':156C 'safeti':234C,266C 'scope':134C 'secur':518C,537C 'server':158C,199C,208C 'servic':293C 'sourc':515C 'sql':157C,198C,207C 'tds':202C,225C,238C,270C,509C 'trust':514C 'two':220C 'type':137C 'unauthent':247C 'understand':196C 'upgrad':412C,522C 'use':171C,516C 'user':154C 'version':295C,399C,422C,425C 'vpc':517C 'wire':200C 'without':160C,211C 'workaround':503C 'workload':159C 'x':314C,320C,338C,356C,371C,384C","first_public_at":"2026-11-06T18:46:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/#CVE-2026-119924","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-06T19:24:10+00:00","fetched_at":"2026-11-06T19:24:10+00:00","note":"AWS: CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL"},{"source":"analyst","external_id":"CVE-2026-119924:1920","url":null,"severity":null,"published_at":"2026-11-06T19:26:24+00:00","modified_at":"2026-11-06T19:26:24+00:00","first_seen_at":"2026-11-06T19:26:24+00:00","fetched_at":"2026-11-06T19:26:24+00:00","note":"Read AWS bulletin 2026-166-AWS. '<<4.5.5' is a typo for '<4.5.5' (fix list gives 16.8.8/4.5.5). Bulletin gives no CVSS; severity left as is. No exploitation or PoC stated; did not search social posts. Shared bulletin with CVE-2026-119923 (sibling)."},{"source":"nvd","external_id":"CVE-2026-119924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119924","severity":null,"published_at":"2026-11-06T19:17:39+00:00","modified_at":"2026-11-06T19:17:39+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","fetched_at":"2026-11-06T19:43:49+00:00","note":null}],"documents":[{"id":89052,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","title":"AWS-2026-166: Issues with Babelfish for Aurora PostgreSQL","kind":"advisory","source":"vendor","publisher":"research","text":"CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\n### CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\nBulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nBabelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code.\n\nWe identified two issues in the Babelfish TDS protocol layer:\n\n- CVE-2026-119923: A memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process.\n- CVE-2026-119924: AA memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service.\n\nImpacted versions:\n\n- Babelfish for PostgreSQL: - 1.0-1.5 - 2.1-2.15 - 3.1-3.12 - 4.0-4.8 - 5.1-5.4 \n- Babelfish for Aurora PostgreSQL: - 1.x: <1.5.5; >=1.6.0 AND <1.17.2 - 2.x: <2.3.5; >=2.4.0 AND <2.12.4; >=2.13.0 AND <2.13.3; >=2.14.0 AND <2.14.2; >=2.15.0 AND <2.15.2; >=2.16.0 AND <2.16.1 - 3.x: <3.8.4; >=3.9.0 AND <3.9.4; >=3.10.0 AND <3.10.3; >=3.11.0 AND <3.11.2; >=3.12.0 AND <3.12.2; >=3.13.0 AND <3.13.1 - 4.x: <<4.5.5; >=4.6.0 AND <4.6.3; >=4.7.0 AND <4.7.2; >=4.8.0 AND <4.8.2; >=4.9.0 AND <4.9.1 - 5.x: <5.1.4; >=5.2.0 AND <5.2.3; >=5.3.0 AND <5.3.2; >=5.4.0 AND <5.4.2; 5.5.0 - 6.x: >=6.0.0 AND <6.0.2\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1. For Amazon Aurora PostgreSQL customers with Babelfish enabled, upgrade your cluster to one of the following Aurora PostgreSQL versions (included Babelfish version in parentheses) or later, and apply any pending maintenance to ensure you are on the latest patch: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0).\n\nWorkarounds:\n\nRestrict network access to the TDS port (default 1433) to trusted sources using VPC security groups until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-119923\n- CVE-2026-119924\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-06T18:46:27+00:00","relation":"mentions","confidence":null,"note":null},{"id":89052,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","title":"AWS-2026-166: Issues with Babelfish for Aurora PostgreSQL","kind":"advisory","source":"vendor","publisher":"research","text":"CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\n### CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\nBulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nBabelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code.\n\nWe identified two issues in the Babelfish TDS protocol layer:\n\n- CVE-2026-119923: A memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process.\n- CVE-2026-119924: AA memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service.\n\nImpacted versions:\n\n- Babelfish for PostgreSQL: - 1.0-1.5 - 2.1-2.15 - 3.1-3.12 - 4.0-4.8 - 5.1-5.4 \n- Babelfish for Aurora PostgreSQL: - 1.x: <1.5.5; >=1.6.0 AND <1.17.2 - 2.x: <2.3.5; >=2.4.0 AND <2.12.4; >=2.13.0 AND <2.13.3; >=2.14.0 AND <2.14.2; >=2.15.0 AND <2.15.2; >=2.16.0 AND <2.16.1 - 3.x: <3.8.4; >=3.9.0 AND <3.9.4; >=3.10.0 AND <3.10.3; >=3.11.0 AND <3.11.2; >=3.12.0 AND <3.12.2; >=3.13.0 AND <3.13.1 - 4.x: <<4.5.5; >=4.6.0 AND <4.6.3; >=4.7.0 AND <4.7.2; >=4.8.0 AND <4.8.2; >=4.9.0 AND <4.9.1 - 5.x: <5.1.4; >=5.2.0 AND <5.2.3; >=5.3.0 AND <5.3.2; >=5.4.0 AND <5.4.2; 5.5.0 - 6.x: >=6.0.0 AND <6.0.2\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1. For Amazon Aurora PostgreSQL customers with Babelfish enabled, upgrade your cluster to one of the following Aurora PostgreSQL versions (included Babelfish version in parentheses) or later, and apply any pending maintenance to ensure you are on the latest patch: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0).\n\nWorkarounds:\n\nRestrict network access to the TDS port (default 1433) to trusted sources using VPC security groups until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-119923\n- CVE-2026-119924\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-06T18:46:27+00:00","relation":"advisory","confidence":null,"note":null},{"id":89335,"url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":89336,"url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60185,"url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}