Description
A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser.



To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.
Published: 2026-11-06
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A heap-based buffer overflow exists in the TDS prelogin parser of Babelfish for PostgreSQL, allowing attackers to trigger arbitrary OS command execution by sending a malformed TDS prelogin packet, thereby running code as the database process user. The flaw is identified as CWE-122 and could compromise confidentiality, integrity, and availability of the affected database system.

Affected Systems

The vulnerability affects Babelfish for PostgreSQL extension versions 1.0 through 1.5, 2.1 through 2.15, 3.1 through 3.12, 4.0 through 4.8, and 5.1 through 5.4, as well as Amazon Aurora PostgreSQL with Babelfish. Any deployments using these versions are susceptible until an update is applied.

Risk and Exploitability

The CVSS score of 9.3 signifies a high severity. While the EPSS score is not available, the vulnerability is remotely exploitable via the TDS port (default 1433) and is not listed in CISA’s KEV catalog, indicating no known active exploitation. The likely attack vector is a malicious client that sends a crafted prelogin packet to the database, triggering the overflow and granting attackers code execution on the host.

Generated by OpenCVE AI on November 6, 2026 at 19:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Babelfish for PostgreSQL extension to version 4.10, 5.6, 6.1 or later.
  • For Amazon Aurora PostgreSQL with Babelfish, upgrade the cluster to the latest supported Aurora PostgreSQL version listed in the advisory (e.g., Aurora PostgreSQL 14.20.5, 15.15.5, 16.14.1, 17.10.1, 18.4.1 or later).
  • Restrict network access to the TDS port (1433) using firewall or security group rules to limit exposure to trusted IP ranges.

Generated by OpenCVE AI on November 6, 2026 at 19:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 18:45:00 +0000

Type Values Removed Values Added
Description A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.
Title Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser
First Time appeared Amazon
Amazon amazon Aurora Postgresql With Babelfish
Aws
Aws babelfish-for-postgresql
Weaknesses CWE-122
CPEs cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*
cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*
Vendors & Products Amazon
Amazon amazon Aurora Postgresql With Babelfish
Aws
Aws babelfish-for-postgresql
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Amazon Amazon Aurora Postgresql With Babelfish
Aws Babelfish-for-postgresql
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-11-06T20:26:39.675Z

Reserved: 2026-10-30T16:59:42.199Z

Link: CVE-2026-119923

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T19:17:39.360

Modified: 2026-11-06T19:17:39.360

Link: CVE-2026-119923

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T19:30:10Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow