Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-119923 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-06 |
| Vendor | Amazon Web Services |
| Product | Babelfish for PostgreSQL / Aurora PostgreSQL |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A heap-based buffer overflow (CWE-122) in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet sent to the TDS port. The attack happens during the connection handshake, before authentication. The CVE record also consolidates a related NULL-pointer-dereference finding in the same prelogin parser.
Babelfish is an open source extension developed by AWS that lets PostgreSQL understand the SQL Server wire protocol (TDS), so applications built for SQL Server can connect without changing drivers. In the same bulletin AWS describes a second issue, CVE-2026-119924 — a memory-safety flaw in TDS remote-procedure-call request handling that allows an authenticated attacker to read adjacent process memory or cause a denial of service. Both are fixed by the same versions.
Required Actions
Babelfish for PostgreSQL (self-managed): upgrade the extension to version 4.10, 5.6 or 6.1 or later.
Amazon Aurora PostgreSQL with Babelfish: the AWS bulletin does not describe an automatic update — customers must upgrade the cluster to one of the following Aurora PostgreSQL versions (Babelfish version in parentheses) or later, and apply any pending maintenance to ensure they are on the latest patch:
- 13.x: 13.9.16 (1.5.5), 13.23.3 (1.17.2)
- 14.x: 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0)
- 15.x: 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0)
- 16.x: 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0)
- 17.x: 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0)
- 18.x: 18.3.4 (6.0.2), 18.4.1 (6.1.0)
Workaround until you upgrade: restrict network access to the TDS port (default 1433) to trusted sources only — with VPC security groups on AWS, or with a firewall for self-managed installations. The TDS port should not be reachable from the internet.
Who Is Affected?
The vulnerability affects organizations running Babelfish for PostgreSQL by Amazon Web Services — most often after migrating applications from Microsoft SQL Server to Amazon Aurora PostgreSQL with Babelfish enabled, or on self-managed PostgreSQL servers with the extension. Aurora PostgreSQL clusters without Babelfish enabled (not listening on the TDS port) are not listed as affected in the bulletin. Check in the AWS RDS console whether the cluster parameter group sets rds.babelfish_status to on.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
