{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "AWS Babelfish for Aurora PostgreSQL TDS parser issues (CVE-2026-119923, CVE-2026-119924) · updates",
  "home_page_url": "https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924",
  "feed_url": "https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924/feed.json",
  "description": "On Nov 6 2026 AWS published Important bulletin 2026-166-AWS for two memory-safety issues in the Babelfish TDS protocol layer used by Babelfish for Aurora PostgreSQL (SQL Server wire protocol). CVE-2026-119923: a memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process. CVE-2026-119924: a memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service. AWS addressed the issues in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1, and lists patched Aurora PostgreSQL versions with Babelfish enabled. Workaround until upgraded: restrict network access to the TDS port (default 1433) to trusted sources using VPC security groups.",
  "language": "en",
  "_pwn": {
    "slug": "aws-babelfish-tds-parser-cve-2026-119923-119924",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924/feed.xml",
    "llms": "https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924/llms.txt",
    "json": "https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924#2026-11-06-977208f9",
      "url": "https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924#2026-11-06-977208f9",
      "title": "AWS Babelfish for Aurora PostgreSQL TDS parser issues (CVE-2026-119923, CVE-2026-119924): AWS publishes Important bulletin 2026-166-AWS for CVE-2026-119923 (TDS connection-handshake memory-safety; remote unauthenticated actor can affect confidentiality, integrity, and availability of the database process) and CVE-2026-119924 (TDS RPC request handling memory-safety; remote authenticated actor can read adjacent process memory or cause DoS). Fixed in Babelfish extension 4.10 / 5.6 / 6.1 and listed Aurora PostgreSQL versions. Workaround: restrict TDS port 1433 via VPC security groups.",
      "content_text": "AWS Babelfish for Aurora PostgreSQL TDS parser issues (CVE-2026-119923, CVE-2026-119924): AWS publishes Important bulletin 2026-166-AWS for CVE-2026-119923 (TDS connection-handshake memory-safety; remote unauthenticated actor can affect confidentiality, integrity, and availability of the database process) and CVE-2026-119924 (TDS RPC request handling memory-safety; remote authenticated actor can read adjacent process memory or cause DoS). Fixed in Babelfish extension 4.10 / 5.6 / 6.1 and listed Aurora PostgreSQL versions. Workaround: restrict TDS port 1433 via VPC security groups.\n\nSource: https://aws.amazon.com/security/security-bulletins/2026-166-aws/",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://aws.amazon.com/security/security-bulletins/2026-166-aws/",
      "tags": [
        "high"
      ]
    }
  ]
}