Babelfish for PostgreSQL TDS prelogin parser heap overflow allows remote command execution

Summary

A heap-based buffer overflow in the TDS prelogin parser of the Babelfish for PostgreSQL extension and Amazon Aurora PostgreSQL with Babelfish lets a remote attacker run OS commands as the database process user. Several earlier versions are affected.

Affected when

• Babelfish for PostgreSQL extension in use
• TDS port (default 1433) reachable over the network

What to do

Update to Babelfish 4.10.0, 5.6.0, or 6.1.0 or later. Aurora clusters should move to the listed release for their line and apply pending maintenance. Until then, restrict network access to the TDS port (default 1433).

Update to at least the version for your product:

• babelfish-for-postgresql 4.x 4.10.0 or later
• babelfish-for-postgresql 5.x 5.6.0 or later
• babelfish-for-postgresql 6.x 6.1.0 or later

Products and platforms

• Amazon Aurora PostgreSQL with Babelfish
• babelfish-for-postgresql

CVE IDs

• CVE-2026-119923 (opens in a new tab)

Sources

• Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · aws.amazon.com (opens in a new tab)
• Write-up: github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-06 18:35 UTC

First seen 2026-11-09 18:30 UTC