AWS warns of two memory-safety flaws in Babelfish for Aurora PostgreSQL
VULNERABILITYAWSredteam/daily · 1 source
- Severity
- High
- Highest CVSS
- 9.3
- Exploited
- Not known
- Sources
- 1
What happened
AWS bulletin 2026-166-AWS, published 11/06/2026, describes two memory-safety issues in the Babelfish TDS protocol layer for Aurora PostgreSQL. CVE-2026-119923 affects connection-handshake handling and may allow a remote, unauthenticated actor to affect the database process. CVE-2026-119924 affects TDS RPC request handling and may allow a remote, authenticated actor to read adjacent process memory or trigger denial of service. The article does not state affected versions or fixed releases, so defenders should review the bulletin for the latest details and restrict network exposure of TDS endpoints.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Review AWS bulletin 2026-166-AWS for the latest details, affected versions and fixes for both CVEs.
- Check whether any Aurora PostgreSQL clusters have Babelfish enabled and limit network access to the TDS endpoint until fixes are confirmed.
Written by AI from the sources, checked against them
Vulnerabilities
- CVE-2026-119923CVSS 9.3A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a spe
- CVE-2026-119924CVSS 7.2An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of servi
Full story timeline · 3 updates
Who reported · 1 outlet
AWS Security Bulletins
Who and what is in it
Companies