--- id: "GHSA-cv9q-3h4j-rv5m" page: "https://infrastack.ai/live/GHSA-cv9q-3h4j-rv5m" kind: "vulnerability" aliases: ["GHSA-cv9q-3h4j-rv5m"] title: "CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL" severity: "unknown" cvss: null epss: null exploited: false status: "open" category: "vendor" products: [] ecosystems: [] tags: ["aurora-postgresql", "aws", "babelfish", "lab-disclosure", "postgresql", "vendor"] not_affected_if: ["babelfish-disabled", "patched-babelfish-version"] published_at: null first_seen_at: "2026-11-09T23:46:35+00:00" updated_at: "2026-11-09T23:48:11+00:00" sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/", "first_seen_at": "2026-11-09T23:46:35+00:00"}] exploit_sources: [] --- # CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL Link for people: https://infrastack.ai/live/GHSA-cv9q-3h4j-rv5m (this .md is for agents) Two memory-safety flaws in Babelfish's handling of the SQL Server wire protocol (TDS) let a remote attacker affect the database process. CVE-2026-119923 can be hit by an unauthenticated remote actor during the connection handshake, and CVE-2026-119924 lets an authenticated actor read adjacent process memory or cause a denial of service. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Check whether Babelfish is enabled on each Aurora PostgreSQL cluster. - Compare each cluster's Babelfish version with the vulnerable ranges listed in AWS bulletin 2026-166-AWS. - Check whether TCP port 1433 (the default TDS port) is reachable from sources outside trusted networks. ## Fix - Babelfish for Aurora PostgreSQL: upgrade to an Aurora PostgreSQL version that includes a fixed Babelfish release, for example `16.14.1` (Babelfish `4.10.0`) or `18.4.1` (Babelfish `6.1.0`), per the bulletin's version table. - Babelfish for PostgreSQL extension: fixed in `4.10`, `5.6` and `6.1`. ## Timeline - 2026-11-09T23:46:35+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/ — AWS: CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL ## Documents - [advisory] AWS: CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/ ## From the sources CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL ### CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL Bulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST Last Updated Date: 11/09/2026 09:45 AM PST Description: Babelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/. Babelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code. We identified two issues in the Babelfish TDS protocol layer: - CVE-2026-119923: A memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process. - CVE-2026-119924: AA memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service. Impacted versions: - Babelfish for PostgreSQL: - 1.0-1.5 - 2.1-2.15 - 3.1-3.12 - 4.0-4.8 - 5.1-5.4 - Babelfish for Aurora PostgreSQL: - 1.x: <1.5.5; >=1.6.0 AND <1.17.2 - 2.x: <2.3.5; >=2.4.0 AND <2.12.4; >=2.13.0 AND <2.13.3; >=2.14.0 AND <2.14.2; >=2.15.0 AND <2.15.2; >=2.16.0 AND <2.16.1 - 3.x: <3.8.4; >=3.9.0 AND <3.9.4; >=3.10.0 AND <3.10.3; >=3.11.0 AND <3.11.2; >=3.12.0 AND <3.12.2; >=3.13.0 AND <3.13.1 - 4.x: <<4.5.5; >=4.6.0 AND <4.6.3; >=4.7.0 AND <4.7.2; >=4.8.0 AND <4.8.2; >=4.9.0 AND <4.9.1 - 5.x: <5.1.4; >=5.2.0 AND <5.2.3; >=5.3.0 AND <5.3.2; >=5.4.0 AND <5.4.2; 5.5.0 - 6.x: >=6.0.0 AND <6.0.2 Resolution: This issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1. For Amazon Aurora PostgreSQL customers with Babelfish enabled, upgrade your cluster to one of the following Aurora PostgreSQL versions (included Babelfish version in parentheses) or later, and apply any pending maintenance to ensure you are on the latest patch: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0). Workarounds: Restrict network access to the TDS port (default 1433) to trusted sources using VPC security groups until the upgrade is applied. References: - CVE-2026-119923 - CVE-2026-119924 - GHSA-vq28-vgj3-r26w - GHSA-cv9q-3h4j-rv5m Please email aws-security@amazon.com with any security questions or concerns. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_