GHSA-cv9q-3h4j-rv5m · Vendor
NO FIX YET · SEE WHAT TO DO
Two memory-safety flaws in Babelfish's handling of the SQL Server wire protocol (TDS) let a remote attacker affect the database process. CVE-2026-119923 can be hit by an unauthenticated remote actor during the connection handshake, and CVE-2026-119924 lets an authenticated actor read adjacent process memory or cause a denial of service.
first public Nov 6, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only clusters running Aurora PostgreSQL with Babelfish enabled are exposed, and only within the vulnerable Babelfish version ranges listed in the bulletin. The TDS port (default 1433) is the entry point, so the risk is highest where that port is reachable from untrusted networks. Teams that do not use Babelfish can skip it.
Not affected if babelfish-disabled, patched-babelfish-version
Who cares aurora-postgresql, aws, babelfish, lab-disclosure, postgresql
16.14.1 (Babelfish 4.10.0) or 18.4.1 (Babelfish 6.1.0), per the bulletin's version table.4.10, and .CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL
Bulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST Last Updated Date: 11/09/2026 09:45 AM PST
Description:
Babelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/.
Babelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code.
We identified two issues in the Babelfish TDS protocol layer:
Impacted versions:
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
5.66.1Resolution:
This issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1. For Amazon Aurora PostgreSQL customers with Babelfish enabled, upgrade your cluster to one of the following Aurora PostgreSQL versions (included Babelfish version in parentheses) or later, and apply any pending maintenance to ensure you are on the latest patch: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0).
Workarounds:
Restrict network access to the TDS port (default 1433) to trusted sources using VPC security groups until the upgrade is applied.
References:
Please email aws-security@amazon.com with any security questions or concerns.