AWS warns of two memory-safety flaws in Babelfish for Aurora PostgreSQL
VULNERABILITYAWSredteam/daily · 1 source
- Severity
- High
- Highest CVSS
- 9.3
- Exploited
- Not known
- Sources
- 1
What happened
Amazon Web Services (AWS) has disclosed two security flaws in Babelfish for Aurora PostgreSQL, a feature that lets the database understand a different database system's language. One flaw could let an outside party affect the database without logging in, and the other could let a logged-in user read nearby memory or crash the service.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Review AWS bulletin 2026-166-AWS for the latest details, affected versions and fixes for both CVEs.
- Check whether any Aurora PostgreSQL clusters have Babelfish enabled and limit network access to the TDS endpoint until fixes are confirmed.
Written by AI from the sources, checked against them
Vulnerabilities
- CVE-2026-119923CVSS 9.3A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a spe
- CVE-2026-119924CVSS 7.2An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of servi
Full story timeline · 3 updates
Who reported · 1 outlet
AWS Security Bulletins
Who and what is in it
Companies