Heap-Based Buffer Overflow in Babelfish for PostgreSQL and Amazon Aurora PostgreSQL
CVE-2026-119923

9.3CRITICAL

Key Information:

Vendor

Aws

Status
Babelfish-for-postgresql
Amazon Aurora Postgresql With Babelfish
Vendor
CVE Published:
6 November 2026

What is CVE-2026-119923?

A significant heap-based buffer overflow vulnerability exists in the TDS prelogin parser within Babelfish for PostgreSQL and Amazon Aurora PostgreSQL. This issue allows remote attackers to potentially execute arbitrary operating system commands with the privileges of the database process user. The vulnerability is triggered by sending specially crafted malformed TDS prelogin packets to the TDS port, amplifying the risk of exploitation. To mitigate this threat, it is crucial for users to upgrade to the recommended versions of Babelfish for PostgreSQL or Amazon Aurora PostgreSQL, or to restrict network access to the TDS port (default 1433).

Affected Version(s)

Amazon Aurora PostgreSQL with Babelfish 1.0.0 < 1.5.5

Amazon Aurora PostgreSQL with Babelfish 1.6.0 < 1.17.2

Amazon Aurora PostgreSQL with Babelfish 2.0.0 < 2.3.5

References

https://github.com/babelfish-for-postgresql/babelfish-for...
release-notespatch
https://github.com/babelfish-for-postgresql/babelfish-for...
release-notespatch
https://github.com/babelfish-for-postgresql/babelfish-for...
release-notespatch

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.