Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

AWS Babelfish for Aurora PostgreSQL TDS parser issues (CVE-2026-119923, CVE-2026-119924)

Babelfish for Aurora PostgreSQL / Babelfish for PostgreSQL extension

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

On Nov 6 2026 AWS published Important bulletin 2026-166-AWS for two memory-safety issues in the Babelfish TDS protocol layer used by Babelfish for Aurora PostgreSQL (SQL Server wire protocol). CVE-2026-119923: a memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process. CVE-2026-119924: a memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service. AWS addressed the issues in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1, and lists patched Aurora PostgreSQL versions with Babelfish enabled. Workaround until upgraded: restrict network access to the TDS port (default 1433) to trusted sources using VPC security groups.

Why this severity: AWS Important (requires attention); unauthenticated handshake issue can affect CIA of the database process; authenticated RPC issue can read adjacent process memory or DoS

Started
Nov 6, 2026
CVEs
CVE-2026-119923CVE-2026-119924

Follow this incident

Discuss on X ↗

Affected

  • Babelfish for PostgreSQL: 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 (per AWS 2026-166-AWS)
  • Babelfish for Aurora PostgreSQL version ranges listed in AWS bulletin 2026-166-AWS (1.x through 6.x impacted bands)

Fixed in

  • Babelfish for PostgreSQL extension 4.10, 5.6, 6.1
  • Aurora PostgreSQL (Babelfish in parentheses) or later per AWS: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0)

Timeline1

  1. AWS publishes Important bulletin 2026-166-AWS for CVE-2026-119923 (TDS connection-handshake memory-safety; remote unauthenticated actor can affect confidentiality, integrity, and availability of the database process) and CVE-2026-119924 (TDS RPC request handling memory-safety; remote authenticated actor can read adjacent process memory or cause DoS). Fixed in Babelfish extension 4.10 / 5.6 / 6.1 and listed Aurora PostgreSQL versions. Workaround: restrict TDS port 1433 via VPC security groups.

Advisories3

Notes & caveats

Use AWS bulletin wording only for impact — do not claim RCE. Related prior Babelfish bulletin 2026-165-AWS (CVE-2026-119922 privilege escalation) is a separate issue in the same product family; not merged here. Do not cite cve.now.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo