Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119924— Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser

Quick assessment

Affected

AWS babelfish-for-postgresql

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Babelfish for PostgreSQL 扩展的 TDS RPC 过程名解析器中存在越界读取漏洞，影响版本 1.0–1.5、2.1–2.15、3.1–3.12、4.0–4.8 和 5.1–5.4，同时也影响集成 Babelfish 的 Amazon Aurora PostgreSQL。该漏洞允许经过身份验证的远程攻击者通过向 TDS 端口（默认 1433）发送畸形的 TDS RPC 请求，读取相邻进程内存或导致拒绝服务。为修复此问题，建议用户将 Babelfish for PostgreSQL 扩展升级至

CVSS 8.1 · High Updated Nov 07, 2026

Possible ATT&CK Techniques 2 AI

T1499.001 · OS Exhaustion Flood T1190 · Exploit Public-Facing Application

Affected Version Matrix 30

Vendor	Product	Version Range	Status
Amazon	Amazon Aurora PostgreSQL with Babelfish	`1.0.0< 1.5.5`	affected
		`1.6.0< 1.17.2`	affected
		`2.0.0< 2.3.5`	affected
		`2.4.0< 2.12.4`	affected
		`2.13.0< 2.13.3`	affected
		`2.14.0< 2.14.2`	affected
		`2.15.0< 2.15.2`	affected
		`2.16.0< 2.16.1`	affected
… +17 more rows
AWS	babelfish-for-postgresql	`1.0≤ 1.5`	affected
		`2.1≤ 2.15`	affected
		`3.1≤ 3.12`	affected
		`4.0≤ 4.8`	affected
		`5.1≤ 5.4`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser

Source: CVE Program / CVE List V5

Vulnerability Description

An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of service via a malformed TDS RPC request to the TDS port (default 1433). To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
AWS	babelfish-for-postgresql	1.0 ~ 1.5	-
Amazon	Amazon Aurora PostgreSQL with Babelfish	1.0.0 ~ 1.5.5	-

II. Public POCs for CVE-2026-119924

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119924

请登录查看更多情报信息。

Other References for CVE-2026-119924 (4)

https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14 release-notes patch
https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4 release-notes patch
https://aws.amazon.com/security/security-bulletins/2026-166-aws/ vendor-advisory
https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10 release-notes patch

https://www.cve.org/CVERecord?id=CVE-2026-119924

Same Patch Batch · AWS · 2026-11-06 · 3 CVEs total

CVE-2026-122193	9.9 CRITICAL	OS command injection in the example SSM documents in Trusted Remote Execution (REX)
CVE-2026-119923	9.8 CRITICAL	Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser

IV. Related Vulnerabilities

Same product: babelfish-for-postgresql

Same vendor: AWS

Same weakness: CWE-125