Out-of-Bounds Read Vulnerability in Babelfish for PostgreSQL Extension by AWS
CVE-2026-119924

7.2HIGH

Key Information:

Vendor

Aws

Status
Babelfish-for-postgresql
Amazon Aurora Postgresql With Babelfish
Vendor
CVE Published:
6 November 2026

What is CVE-2026-119924?

A significant out-of-bounds read vulnerability has been identified in the TDS RPC procedure-name parser within various versions of the Babelfish for PostgreSQL extension. This issue allows remote authenticated users to potentially access adjacent memory or trigger a denial of service when presenting a malformed TDS RPC request to the default TDS port (1433). To mitigate this risk, users should promptly upgrade to the latest Babelfish extension versions or restrict network access to the TDS port. For those utilizing Amazon Aurora PostgreSQL with Babelfish, it is essential to upgrade to specified newer cluster versions to ensure protection.

Affected Version(s)

Amazon Aurora PostgreSQL with Babelfish 1.0.0 < 1.5.5

Amazon Aurora PostgreSQL with Babelfish 1.6.0 < 1.17.2

Amazon Aurora PostgreSQL with Babelfish 2.0.0 < 2.3.5

References

https://github.com/babelfish-for-postgresql/babelfish-for...
release-notespatch
https://github.com/babelfish-for-postgresql/babelfish-for...
release-notespatch
https://github.com/babelfish-for-postgresql/babelfish-for...
release-notespatch

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.