{"id":"GHSA-vq28-vgj3-r26w","kind":"vulnerability","aliases":["GHSA-vq28-vgj3-r26w"],"related":[],"title":"CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL","description":"CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\n### CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\nBulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST Last Updated Date: 11/09/2026 09:45 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nBabelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code.\n\nWe identified two issues in the Babelfish TDS protocol layer:\n\n- CVE-2026-119923: A memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process.\n- CVE-2026-119924: AA memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service.\n\nImpacted versions:\n\n- Babelfish for PostgreSQL: - 1.0-1.5 - 2.1-2.15 - 3.1-3.12 - 4.0-4.8 - 5.1-5.4 \n- Babelfish for Aurora PostgreSQL: - 1.x: <1.5.5; >=1.6.0 AND <1.17.2 - 2.x: <2.3.5; >=2.4.0 AND <2.12.4; >=2.13.0 AND <2.13.3; >=2.14.0 AND <2.14.2; >=2.15.0 AND <2.15.2; >=2.16.0 AND <2.16.1 - 3.x: <3.8.4; >=3.9.0 AND <3.9.4; >=3.10.0 AND <3.10.3; >=3.11.0 AND <3.11.2; >=3.12.0 AND <3.12.2; >=3.13.0 AND <3.13.1 - 4.x: <<4.5.5; >=4.6.0 AND <4.6.3; >=4.7.0 AND <4.7.2; >=4.8.0 AND <4.8.2; >=4.9.0 AND <4.9.1 - 5.x: <5.1.4; >=5.2.0 AND <5.2.3; >=5.3.0 AND <5.3.2; >=5.4.0 AND <5.4.2; 5.5.0 - 6.x: >=6.0.0 AND <6.0.2\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1. For Amazon Aurora PostgreSQL customers with Babelfish enabled, upgrade your cluster to one of the following Aurora PostgreSQL versions (included Babelfish version in parentheses) or later, and apply any pending maintenance to ensure you are on the latest patch: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0).\n\nWorkarounds:\n\nRestrict network access to the TDS port (default 1433) to trusted sources using VPC security groups until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-119923\n- CVE-2026-119924\n- GHSA-vq28-vgj3-r26w\n- GHSA-cv9q-3h4j-rv5m\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Two memory-safety bugs in the Babelfish TDS (SQL Server wire protocol) layer of Babelfish for Aurora PostgreSQL. One is in the connection handshake and can be reached by an unauthenticated remote actor; the other is in RPC request handling, reachable by an authenticated actor, and can leak adjacent process memory or cause a denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aurora-postgresql","aws","babelfish","database","lab-disclosure","sql-server-compatibility","vendor"],"not_affected_if":["babelfish-not-enabled","fixed-version","no-tds-exposure"],"how_to_check":"- Check whether the cluster has Babelfish enabled and which Babelfish version it runs, then compare it with the affected ranges in the bulletin.\n- Check whether TDS port `1433` is reachable from networks outside your trusted sources (VPC security groups).\n- Open the bulletin at https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/ to confirm your version range.","fix":"- Aurora PostgreSQL with Babelfish: upgrade to one of the listed versions or later, for example `14.23.1` (Babelfish `2.17.0`), `15.18.1` (Babelfish `3.14.0`), `16.14.1` (Babelfish `4.10.0`), `17.10.1` (Babelfish `5.6.0`), `18.4.1` (Babelfish `6.1.0`), then apply pending maintenance.\n- Babelfish for PostgreSQL extension (open source): `4.10`, `5.6` and `6.1`.\n- Until the upgrade is applied, restrict access to TDS port `1433` to trusted sources.","status":"open","published_at":null,"first_seen_at":"2026-11-09T23:46:35+00:00","triaged_at":"2026-11-09T23:48:14+00:00","updated_at":"2026-11-09T23:48:14+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-09T23:48:14Z","model":"claude-haiku-5-5","output":{"fix":"- Aurora PostgreSQL with Babelfish: upgrade to one of the listed versions or later, for example `14.23.1` (Babelfish `2.17.0`), `15.18.1` (Babelfish `3.14.0`), `16.14.1` (Babelfish `4.10.0`), `17.10.1` (Babelfish `5.6.0`), `18.4.1` (Babelfish `6.1.0`), then apply pending maintenance.\n- Babelfish for PostgreSQL extension (open source): `4.10`, `5.6` and `6.1`.\n- Until the upgrade is applied, restrict access to TDS port `1433` to trusted sources.","reach":"network","title":"Aurora PostgreSQL Babelfish: TDS memory-safety flaws expose database process memory","impact":"high","summary":"Two memory-safety bugs in the Babelfish TDS (SQL Server wire protocol) layer of Babelfish for Aurora PostgreSQL. One is in the connection handshake and can be reached by an unauthenticated remote actor; the other is in RPC request handling, reachable by an authenticated actor, and can leak adjacent process memory or cause a denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["aurora-postgresql","babelfish","sql-server-compatibility","database"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attacker affects database process; another user's memory leaks","analyst_note":"","how_to_check":"- Check whether the cluster has Babelfish enabled and which Babelfish version it runs, then compare it with the affected ranges in the bulletin.\n- Check whether TDS port `1433` is reachable from networks outside your trusted sources (VPC security groups).\n- Open the bulletin at https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/ to confirm your version range.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["babelfish-not-enabled","fixed-version","no-tds-exposure"],"who_is_affected":"Only Aurora PostgreSQL clusters with Babelfish enabled are exposed, because the flaws are in Babelfish's SQL Server protocol handling. The bulletin's version ranges cover Babelfish 1.x through 6.x; the handshake flaw is reachable without credentials, so exposed TDS ports matter most. Clusters without Babelfish, and clusters on fixed versions, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001558,"input_tokens":6251,"output_tokens":1865,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1.5':301C '-119923':3A,98C,111C,231C,529C '-119924':7A,102C,115C,263C,532C '-166':125C '-2.15':303C '-2026':2A,6A,97C,101C,110C,114C,230C,262C,528C,531C '-3.12':305C '-4.8':307C '-5.4':309C '/babelfish-for-postgresql/babelfish_extensions/.':187C '00':138C '09':145C '1':314C '1.0':300C '1.17.2':319C,447C '1.5.5':316C,445C '1.6.0':317C '10':137C '11/06/2026':136C '11/09/2026':144C '13.23.3':446C '13.9.16':444C '14.17.8':450C '14.18.6':452C '14.19.5':454C '14.20.5':456C '14.22.3':458C '14.23.1':460C '14.6.16':448C '1433':513C '15.10.8':462C '15.12.8':464C '15.13.6':466C '15.14.5':468C '15.15.5':470C '15.17.3':472C '15.18.1':474C '16.10.5':480C '16.11.5':482C '16.13.3':484C '16.14.1':486C '16.8.8':476C '16.9.6':478C '17.10.1':498C '17.4.8':488C '17.5.6':490C '17.6.5':492C '17.7.5':494C '17.9.3':496C '18.3.4':500C '18.4.1':502C '2':320C '2.1':302C '2.12.4':325C,451C '2.13.0':326C '2.13.3':328C,453C '2.14.0':329C '2.14.2':331C,455C '2.15.0':332C '2.15.2':334C,457C '2.16.0':335C '2.16.1':337C,459C '2.17.0':461C '2.3.5':322C,449C '2.4.0':323C '2026':124C '3':338C '3.1':304C '3.10.0':344C '3.10.3':346C,467C '3.11.0':347C '3.11.2':349C,469C '3.12.0':350C '3.12.2':352C,471C '3.13.0':353C '3.13.1':355C,473C '3.14.0':475C '3.8.4':340C,463C '3.9.0':341C '3.9.4':343C,465C '3h4j':541C '4':356C '4.0':306C '4.10':401C '4.10.0':487C '4.5.5':358C,477C '4.6.0':359C '4.6.3':361C,479C '4.7.0':362C '4.7.2':364C,481C '4.8.0':365C '4.8.2':367C,483C '4.9.0':368C '4.9.1':370C,485C '45':146C '5':371C '5.1':308C '5.1.4':373C,489C '5.2.0':374C '5.2.3':376C,491C '5.3.0':377C '5.3.2':379C,493C '5.4.0':380C '5.4.2':382C,495C '5.5.0':383C '5.5.1':497C '5.6':402C '5.6.0':499C '6':384C '6.0.0':386C '6.0.2':388C,501C '6.1':404C '6.1.0':503C 'aa':264C 'access':507C 'actor':71B,83B,249C,283C 'address':394C 'adjac':87B,286C 'affect':251C 'allow':204C,245C,279C 'amazon':193C,406C 'appli':432C,525C 'applic':164C,205C,217C 'attent':133C 'aurora':12A,25B,55B,107C,120C,190C,194C,312C,407C,421C 'aurora-postgresql':24B 'authent':82B,282C 'avail':256C 'aw':27B,126C,128C,184C 'aws-security@amazon.com':545C 'babelfish':10A,28B,45B,53B,105C,118C,150C,165C,188C,225C,297C,310C,396C,411C,425C 'bug':42B 'built':206C 'bulletin':122C 'call':275C 'caus':91B,290C 'chang':213C 'cluster':415C 'code':218C 'compat':36B 'concern':551C 'confidenti':253C 'connect':61B,211C,241C 'connection-handshak':240C 'content':129C 'could':244C,278C 'custom':409C 'cv9q':540C 'cve':1A,5A,96C,100C,109C,113C,229C,261C,527C,530C 'databas':29B,259C 'date':135C,143C 'default':512C 'denial':93B,292C 'descript':149C 'develop':167C 'disclosur':32B 'driver':214C 'email':544C 'enabl':154C,192C,412C 'ensur':437C 'extens':153C,176C,399C 'follow':420C 'ghsa':15A,20A,534C,539C 'ghsa-cv9q-3h4j-rv5m':538C 'ghsa-vq28-vgj3-r26w':14A,19A,533C 'github.com':186C 'github.com/babelfish-for-postgresql/babelfish_extensions/.':185C 'group':520C 'handl':78B,243C,277C 'handshak':62B,242C 'id':123C 'identifi':220C 'impact':295C 'import':131C 'includ':424C 'integr':254C 'issu':8A,103C,116C,222C,236C,268C,391C 'lab':31B 'lab-disclosur':30B 'last':141C 'later':430C 'latest':442C 'layer':51B,228C 'leak':86B 'maintain':182C 'mainten':435C 'memori':40B,89B,234C,266C,288C 'memory-safeti':39B,233C,265C 'model':177C 'modifi':162C 'network':506C 'one':57B,417C 'opensourc':170C 'own':180C 'parenthes':428C 'patch':443C 'pend':434C 'pleas':543C 'port':511C 'postgresql':13A,26B,56B,108C,121C,152C,174C,191C,195C,299C,313C,398C,408C,422C 'procedur':274C 'process':88B,260C,287C 'project':171C 'protocol':50B,202C,227C 'pst':140C,148C 'public':134C 'question':549C 'r26w':18A,23A,537C 'reach':66B 'reachabl':79B 'read':285C 'refer':526C 'remot':70B,247C,273C,281C 'remote-procedure-cal':272C 'request':77B,276C 'requir':132C 'resolut':389C 'restrict':505C 'rewrit':216C 'rpc':76B 'run':157C 'rv5m':542C 'safeti':41B,235C,267C 'scope':127C 'secur':519C,548C 'server':35B,48B,159C,200C,209C 'servic':95B,294C 'sourc':516C 'sql':34B,47B,158C,199C,208C 'sql-server-compat':33B 'tds':46B,203C,226C,239C,271C,510C 'trust':515C 'two':38B,221C 'type':130C 'unauthent':69B,248C 'understand':197C 'updat':142C 'upgrad':413C,523C 'use':172C,517C 'user':155C 'vendor':37B 'version':296C,400C,423C,426C 'vgj3':17A,22A,536C 'vpc':518C 'vq28':16A,21A,535C 'wire':49B,201C 'without':161C,212C 'workaround':504C 'workload':160C 'x':315C,321C,339C,357C,372C,385C","nicknames":[],"mitigations":[],"who_affected":"Only Aurora PostgreSQL clusters with Babelfish enabled are exposed, because the flaws are in Babelfish's SQL Server protocol handling. The bulletin's version ranges cover Babelfish 1.x through 6.x; the handshake flaw is reachable without credentials, so exposed TDS ports matter most. Clusters without Babelfish, and clusters on fixed versions, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aurorapostgresql","aws","babelfish","database","labdisclosure","sqlservercompatibility","unknown","vendor"],"campaign_type":null,"search_a":"'-119923':3A '-119924':7A '-2026':2A,6A 'aurora':12A 'babelfish':10A 'cve':1A,5A 'ghsa':15A,20A 'ghsa-vq28-vgj3-r26w':14A,19A 'issu':8A 'postgresql':13A 'r26w':18A,23A 'vgj3':17A,22A 'vq28':16A,21A","search_b":"'actor':71B,83B 'adjac':87B 'aurora':25B,55B 'aurora-postgresql':24B 'authent':82B 'aw':27B 'babelfish':28B,45B,53B 'bug':42B 'caus':91B 'compat':36B 'connect':61B 'databas':29B 'denial':93B 'disclosur':32B 'handl':78B 'handshak':62B 'lab':31B 'lab-disclosur':30B 'layer':51B 'leak':86B 'memori':40B,89B 'memory-safeti':39B 'one':57B 'postgresql':26B,56B 'process':88B 'protocol':50B 'reach':66B 'reachabl':79B 'remot':70B 'request':77B 'rpc':76B 'safeti':41B 'server':35B,48B 'servic':95B 'sql':34B,47B 'sql-server-compat':33B 'tds':46B 'two':38B 'unauthent':69B 'vendor':37B 'wire':49B","search_c":"'-1.5':301C '-119923':98C,111C,231C,529C '-119924':102C,115C,263C,532C '-166':125C '-2.15':303C '-2026':97C,101C,110C,114C,230C,262C,528C,531C '-3.12':305C '-4.8':307C '-5.4':309C '/babelfish-for-postgresql/babelfish_extensions/.':187C '00':138C '09':145C '1':314C '1.0':300C '1.17.2':319C,447C '1.5.5':316C,445C '1.6.0':317C '10':137C '11/06/2026':136C '11/09/2026':144C '13.23.3':446C '13.9.16':444C '14.17.8':450C '14.18.6':452C '14.19.5':454C '14.20.5':456C '14.22.3':458C '14.23.1':460C '14.6.16':448C '1433':513C '15.10.8':462C '15.12.8':464C '15.13.6':466C '15.14.5':468C '15.15.5':470C '15.17.3':472C '15.18.1':474C '16.10.5':480C '16.11.5':482C '16.13.3':484C '16.14.1':486C '16.8.8':476C '16.9.6':478C '17.10.1':498C '17.4.8':488C '17.5.6':490C '17.6.5':492C '17.7.5':494C '17.9.3':496C '18.3.4':500C '18.4.1':502C '2':320C '2.1':302C '2.12.4':325C,451C '2.13.0':326C '2.13.3':328C,453C '2.14.0':329C '2.14.2':331C,455C '2.15.0':332C '2.15.2':334C,457C '2.16.0':335C '2.16.1':337C,459C '2.17.0':461C '2.3.5':322C,449C '2.4.0':323C '2026':124C '3':338C '3.1':304C '3.10.0':344C '3.10.3':346C,467C '3.11.0':347C '3.11.2':349C,469C '3.12.0':350C '3.12.2':352C,471C '3.13.0':353C '3.13.1':355C,473C '3.14.0':475C '3.8.4':340C,463C '3.9.0':341C '3.9.4':343C,465C '3h4j':541C '4':356C '4.0':306C '4.10':401C '4.10.0':487C '4.5.5':358C,477C '4.6.0':359C '4.6.3':361C,479C '4.7.0':362C '4.7.2':364C,481C '4.8.0':365C '4.8.2':367C,483C '4.9.0':368C '4.9.1':370C,485C '45':146C '5':371C '5.1':308C '5.1.4':373C,489C '5.2.0':374C '5.2.3':376C,491C '5.3.0':377C '5.3.2':379C,493C '5.4.0':380C '5.4.2':382C,495C '5.5.0':383C '5.5.1':497C '5.6':402C '5.6.0':499C '6':384C '6.0.0':386C '6.0.2':388C,501C '6.1':404C '6.1.0':503C 'aa':264C 'access':507C 'actor':249C,283C 'address':394C 'adjac':286C 'affect':251C 'allow':204C,245C,279C 'amazon':193C,406C 'appli':432C,525C 'applic':164C,205C,217C 'attent':133C 'aurora':107C,120C,190C,194C,312C,407C,421C 'authent':282C 'avail':256C 'aw':126C,128C,184C 'aws-security@amazon.com':545C 'babelfish':105C,118C,150C,165C,188C,225C,297C,310C,396C,411C,425C 'built':206C 'bulletin':122C 'call':275C 'caus':290C 'chang':213C 'cluster':415C 'code':218C 'concern':551C 'confidenti':253C 'connect':211C,241C 'connection-handshak':240C 'content':129C 'could':244C,278C 'custom':409C 'cv9q':540C 'cve':96C,100C,109C,113C,229C,261C,527C,530C 'databas':259C 'date':135C,143C 'default':512C 'denial':292C 'descript':149C 'develop':167C 'driver':214C 'email':544C 'enabl':154C,192C,412C 'ensur':437C 'extens':153C,176C,399C 'follow':420C 'ghsa':534C,539C 'ghsa-cv9q-3h4j-rv5m':538C 'ghsa-vq28-vgj3-r26w':533C 'github.com':186C 'github.com/babelfish-for-postgresql/babelfish_extensions/.':185C 'group':520C 'handl':243C,277C 'handshak':242C 'id':123C 'identifi':220C 'impact':295C 'import':131C 'includ':424C 'integr':254C 'issu':103C,116C,222C,236C,268C,391C 'last':141C 'later':430C 'latest':442C 'layer':228C 'maintain':182C 'mainten':435C 'memori':234C,266C,288C 'memory-safeti':233C,265C 'model':177C 'modifi':162C 'network':506C 'one':417C 'opensourc':170C 'own':180C 'parenthes':428C 'patch':443C 'pend':434C 'pleas':543C 'port':511C 'postgresql':108C,121C,152C,174C,191C,195C,299C,313C,398C,408C,422C 'procedur':274C 'process':260C,287C 'project':171C 'protocol':202C,227C 'pst':140C,148C 'public':134C 'question':549C 'r26w':537C 'read':285C 'refer':526C 'remot':247C,273C,281C 'remote-procedure-cal':272C 'request':276C 'requir':132C 'resolut':389C 'restrict':505C 'rewrit':216C 'run':157C 'rv5m':542C 'safeti':235C,267C 'scope':127C 'secur':519C,548C 'server':159C,200C,209C 'servic':294C 'sourc':516C 'sql':158C,199C,208C 'tds':203C,226C,239C,271C,510C 'trust':515C 'two':221C 'type':130C 'unauthent':248C 'understand':197C 'updat':142C 'upgrad':413C,523C 'use':172C,517C 'user':155C 'version':296C,400C,423C,426C 'vgj3':536C 'vpc':518C 'vq28':535C 'wire':201C 'without':161C,212C 'workaround':504C 'workload':160C 'x':315C,321C,339C,357C,372C,385C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-06T18:46:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/#GHSA-vq28-vgj3-r26w","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-09T23:46:35+00:00","fetched_at":"2026-11-09T23:46:35+00:00","note":"AWS: CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL"}],"documents":[{"id":89052,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","title":"AWS: CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL","kind":"advisory","source":"vendor","publisher":"research","text":"CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\n### CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL\n\nBulletin ID: 2026-166-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 10:00 AM PST Last Updated Date: 11/09/2026 09:45 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nBabelfish for Aurora PostgreSQL enables Amazon Aurora PostgreSQL to understand the SQL Server wire protocol (TDS), allowing applications built for SQL Server to connect without changing drivers or rewriting application code.\n\nWe identified two issues in the Babelfish TDS protocol layer:\n\n- CVE-2026-119923: A memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process.\n- CVE-2026-119924: AA memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service.\n\nImpacted versions:\n\n- Babelfish for PostgreSQL: - 1.0-1.5 - 2.1-2.15 - 3.1-3.12 - 4.0-4.8 - 5.1-5.4 \n- Babelfish for Aurora PostgreSQL: - 1.x: <1.5.5; >=1.6.0 AND <1.17.2 - 2.x: <2.3.5; >=2.4.0 AND <2.12.4; >=2.13.0 AND <2.13.3; >=2.14.0 AND <2.14.2; >=2.15.0 AND <2.15.2; >=2.16.0 AND <2.16.1 - 3.x: <3.8.4; >=3.9.0 AND <3.9.4; >=3.10.0 AND <3.10.3; >=3.11.0 AND <3.11.2; >=3.12.0 AND <3.12.2; >=3.13.0 AND <3.13.1 - 4.x: <<4.5.5; >=4.6.0 AND <4.6.3; >=4.7.0 AND <4.7.2; >=4.8.0 AND <4.8.2; >=4.9.0 AND <4.9.1 - 5.x: <5.1.4; >=5.2.0 AND <5.2.3; >=5.3.0 AND <5.3.2; >=5.4.0 AND <5.4.2; 5.5.0 - 6.x: >=6.0.0 AND <6.0.2\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1. For Amazon Aurora PostgreSQL customers with Babelfish enabled, upgrade your cluster to one of the following Aurora PostgreSQL versions (included Babelfish version in parentheses) or later, and apply any pending maintenance to ensure you are on the latest patch: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0).\n\nWorkarounds:\n\nRestrict network access to the TDS port (default 1433) to trusted sources using VPC security groups until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-119923\n- CVE-2026-119924\n- GHSA-vq28-vgj3-r26w\n- GHSA-cv9q-3h4j-rv5m\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-06T18:46:27+00:00","relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}