AWS warns of two memory-safety flaws in Babelfish for Aurora PostgreSQL
VULNERABILITYAWSredteam/daily · 1 source
- Severity
- High
- Highest CVSS
- 9.3
- Exploited
- Not known
- Sources
- 1
What happened
AWS bulletin 2026-166-AWS covers two memory-safety issues in the TDS protocol layer of Babelfish for Aurora PostgreSQL. CVE-2026-119923 in connection-handshake handling could let a remote, unauthenticated actor affect the database process. CVE-2026-119924 in RPC request handling could let a remote, authenticated actor read adjacent process memory or cause a denial of service.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Review AWS bulletin 2026-166-AWS for the latest details, affected versions and fixes for both CVEs.
- Check whether any Aurora PostgreSQL clusters have Babelfish enabled and limit network access to the TDS endpoint until fixes are confirmed.
Written by AI from the sources, checked against them
Vulnerabilities
- CVE-2026-119923CVSS 9.3A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a spe
- CVE-2026-119924CVSS 7.2An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of servi
Full story timeline · 3 updates
Who reported · 1 outlet
AWS Security Bulletins
Who and what is in it
Companies