AWS patches critical TDS prelogin buffer overflow in Babelfish for Aurora PostgreSQL

Nov 9, 20261 min readEdition: 2026-11-09-cybersecurity-advisories

Topographic elevation contour card for AWS patches critical TDS prelogin buffer overflow in Babelfish for Aurora PostgreSQL — VISUAL ARTWORK:Original editorial artwork. Third-party brand marks used under nominative fair use.

What happened.Amazon Web Services published security bulletin 2026-166-AWS resolving critical memory corruption flaws in the open-source Babelfish for PostgreSQL extension.

Why it matters.Babelfish allows legacy SQL Server workloads to migrate to cloud PostgreSQL databases without rewrite. When default TDS ports accept packets that corrupt heap memory, attackers gain system execution on database hosts. Teams running Aurora PostgreSQL with Babelfish should apply minor engine updates. Cloud architects should restrict access to port 1433 using private security groups.

The technical specifications:

Vulnerability mechanics: Tracked as CVE-2026-119923 with a 9.8 CVSS score, a heap-based buffer overflow in the TDS prelogin parser enables unauthenticated remote code execution.
Adjacent disclosure: Tracked as CVE-2026-119924 with an 8.1 CVSS score, an out-of-bounds read flaw in the TDS RPC parser allows memory leakage.
Protocol exposure: The flaws exist in the Tabular Data Stream protocol on port 1433, which emulates Microsoft SQL Server on PostgreSQL clusters.
Affected versions: The vulnerabilities impact Babelfish extension releases across versions 1.0 through 5.4 in self-managed and cloud database stacks.
Remediation releases: AWS deployed patched Aurora PostgreSQL engine updates and released open-source Babelfish versions 4.10, 5.6, and 6.1.

TOPICS:

#security #vulnerability #cloud #database