# AWS Babelfish for Aurora PostgreSQL TDS parser issues (CVE-2026-119923, CVE-2026-119924) · pwn.watch

> On Nov 6 2026 AWS published Important bulletin 2026-166-AWS for two memory-safety issues in the Babelfish TDS protocol layer used by Babelfish for Aurora PostgreSQL (SQL Server wire protocol). CVE-2026-119923: a memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process. CVE-2026-119924: a memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service. AWS addressed the issues in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1, and lists patched Aurora PostgreSQL versions with Babelfish enabled. Workaround until upgraded: restrict network access to the TDS port (default 1433) to trusted sources using VPC security groups.

Page: https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924 · generated 2026-11-07T01:17:54.732Z

## Status
- Severity: high · status: live · patch: patched
- Product: Babelfish for Aurora PostgreSQL / Babelfish for PostgreSQL extension
- Started: 2026-11-06
- CVEs: CVE-2026-119923, CVE-2026-119924
- Affected: Babelfish for PostgreSQL: 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 (per AWS 2026-166-AWS); Babelfish for Aurora PostgreSQL version ranges listed in AWS bulletin 2026-166-AWS (1.x through 6.x impacted bands)
- Fixed in: Babelfish for PostgreSQL extension 4.10, 5.6, 6.1; Aurora PostgreSQL (Babelfish in parentheses) or later per AWS: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924/feed.xml
- JSON Feed: https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924.json
- This file: https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924/llms.txt

## Updates (newest first)
- 2026-11-06: AWS publishes Important bulletin 2026-166-AWS for CVE-2026-119923 (TDS connection-handshake memory-safety; remote unauthenticated actor can affect confidentiality, integrity, and availability of the database process) and CVE-2026-119924 (TDS RPC request handling memory-safety; remote authenticated actor can read adjacent process memory or cause DoS). Fixed in Babelfish extension 4.10 / 5.6 / 6.1 and listed Aurora PostgreSQL versions. Workaround: restrict TDS port 1433 via VPC security groups. (https://aws.amazon.com/security/security-bulletins/2026-166-aws/)

## Fix brief
# Security brief: AWS Babelfish for Aurora PostgreSQL TDS parser issues (CVE-2026-119923, CVE-2026-119924)

Source: https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924 · status: live · severity: high · updated Nov 6, 2026, 22:05 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
On Nov 6 2026 AWS published Important bulletin 2026-166-AWS for two memory-safety issues in the Babelfish TDS protocol layer used by Babelfish for Aurora PostgreSQL (SQL Server wire protocol). CVE-2026-119923: a memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process. CVE-2026-119924: a memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service. AWS addressed the issues in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1, and lists patched Aurora PostgreSQL versions with Babelfish enabled. Workaround until upgraded: restrict network access to the TDS port (default 1433) to trusted sources using VPC security groups.

Severity detail: AWS Important (requires attention); unauthenticated handshake issue can affect CIA of the database process; authenticated RPC issue can read adjacent process memory or DoS

- Product: Babelfish for Aurora PostgreSQL / Babelfish for PostgreSQL extension
- CVE / advisory ids: CVE-2026-119923, CVE-2026-119924

## Affected versions
- Babelfish for PostgreSQL: 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 (per AWS 2026-166-AWS)
- Babelfish for Aurora PostgreSQL version ranges listed in AWS bulletin 2026-166-AWS (1.x through 6.x impacted bands)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Babelfish for PostgreSQL extension 4.10, 5.6, 6.1
- Aurora PostgreSQL (Babelfish in parentheses) or later per AWS: 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Aurora customers with Babelfish enabled: upgrade the cluster to a listed Aurora PostgreSQL version (or later) and apply pending maintenance. Until then restrict TDS 1433 to trusted sources via VPC security groups.

## Latest updates
- Nov 6, 2026: AWS publishes Important bulletin 2026-166-AWS for CVE-2026-119923 (TDS connection-handshake memory-safety; remote unauthenticated actor can affect confidentiality, integrity, and availability of the database process) and CVE-2026-119924 (TDS RPC request handling memory-safety; remote authenticated actor can read adjacent process memory or cause DoS). Fixed in Babelfish extension 4.10 / 5.6 / 6.1 and listed Aurora PostgreSQL versions. Workaround: restrict TDS port 1433 via VPC security groups.

## Advisories
- [CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL (2026-166-AWS)](https://aws.amazon.com/security/security-bulletins/2026-166-aws/) (AWS)
- [NVD CVE-2026-119923](https://nvd.nist.gov/vuln/detail/CVE-2026-119923) (NVD)
- [NVD CVE-2026-119924](https://nvd.nist.gov/vuln/detail/CVE-2026-119924) (NVD)

## Caveats
Use AWS bulletin wording only for impact — do not claim RCE. Related prior Babelfish bulletin 2026-165-AWS (CVE-2026-119922 privilege escalation) is a separate issue in the same product family; not merged here. Do not cite cve.now.

---
Machine-readable: https://pwn.watch/i/aws-babelfish-tds-parser-cve-2026-119923-119924.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.