AWS Babelfish for Aurora PostgreSQL TDS parser issues (CVE-2026-119923, CVE-2026-119924) ยท updates https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924 On Nov 6 2026 AWS published Important bulletin 2026-166-AWS for two memory-safety issues in the Babelfish TDS protocol layer used by Babelfish for Aurora PostgreSQL (SQL Server wire protocol). CVE-2026-119923: a memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process. CVE-2026-119924: a memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service. AWS addressed the issues in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1, and lists patched Aurora PostgreSQL versions with Babelfish enabled. Workaround until upgraded: restrict network access to the TDS port (default 1433) to trusted sources using VPC security groups. en Fri, 06 Nov 2026 00:00:00 GMT AWS Babelfish for Aurora PostgreSQL TDS parser issues (CVE-2026-119923, CVE-2026-119924): AWS publishes Important bulletin 2026-166-AWS for CVE-2026-119923 (TDS connection-handshake memory-safety; remote unauthenticated actor can affect confidentiality, integrity, and availability of the database process) and CVE-2026-119924 (TDS RPC request handling memory-safety; remote authenticated actor can read adjacent process memory or cause DoS). Fixed in Babelfish extension 4.10 / 5.6 / 6.1 and listed Aurora PostgreSQL versions. Workaround: restrict TDS port 1433 via VPC security groups. https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924 https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924#2026-11-06-977208f9 Fri, 06 Nov 2026 00:00:00 GMT high <p><a href="https://aws.amazon.com/security/security-bulletins/2026-166-aws/">Source</a></p>