Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119923— Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser

Quick assessment

Affected

AWS babelfish-for-postgresql

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Babelfish for PostgreSQL 扩展的 TDS 预登录解析器中存在一个基于堆的缓冲区溢出漏洞，影响版本 1.0–1.5、2.1–2.15、3.1–3.12、4.0–4.8 和 5.1–5.4；同时，Amazon Aurora PostgreSQL 若启用了 Babelfish 也会受到此漏洞影响。该漏洞允许远程攻击者通过向 TDS 端口（默认端口 1433）发送精心构造的畸形 TDS 预登录数据包，以数据库进程用户的身份执行任意操作系统命令。本记录还整合了同一预登录解析器中发现的相关空指针解引用问

CVSS 9.8 · Critical Updated Nov 07, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 30

Vendor	Product	Version Range	Status
Amazon	Amazon Aurora PostgreSQL with Babelfish	`1.0.0< 1.5.5`	affected
		`1.6.0< 1.17.2`	affected
		`2.0.0< 2.3.5`	affected
		`2.4.0< 2.12.4`	affected
		`2.13.0< 2.13.3`	affected
		`2.14.0< 2.14.2`	affected
		`2.15.0< 2.15.2`	affected
		`2.16.0< 2.16.1`	affected
… +17 more rows
AWS	babelfish-for-postgresql	`1.0≤ 1.5`	affected
		`2.1≤ 2.15`	affected
		`3.1≤ 3.12`	affected
		`4.0≤ 4.8`	affected
		`5.1≤ 5.4`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser

Source: CVE Program / CVE List V5

Vulnerability Description

A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

堆缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
AWS	babelfish-for-postgresql	1.0 ~ 1.5	-
Amazon	Amazon Aurora PostgreSQL with Babelfish	1.0.0 ~ 1.5.5	-

II. Public POCs for CVE-2026-119923

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119923

请登录查看更多情报信息。

Other References for CVE-2026-119923 (4)

https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14 release-notes patch
https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4 release-notes patch
https://aws.amazon.com/security/security-bulletins/2026-166-aws/ vendor-advisory
https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10 release-notes patch

https://www.cve.org/CVERecord?id=CVE-2026-119923

Same Patch Batch · AWS · 2026-11-06 · 3 CVEs total

CVE-2026-122193	9.9 CRITICAL	OS command injection in the example SSM documents in Trusted Remote Execution (REX)
CVE-2026-119924	8.1 HIGH	Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser

IV. Related Vulnerabilities

Same product: babelfish-for-postgresql

Same vendor: AWS

Same weakness: CWE-122