CVE-2026-119924

Name of the Vulnerable Software and Affected Versions Babelfish for PostgreSQL versions 1.0 through 1.5 Babelfish for PostgreSQL versions 2.1 through 2.15 Babelfish for PostgreSQL versions 3.1 through 3.12 Babelfish for PostgreSQL versions 4.0 through 4.8 Babelfish for PostgreSQL versions 5.1 through 5.4 Amazon Aurora PostgreSQL with Babelfish (affected versions not specified)

Description An out-of-bounds read exists in the TDS RPC procedure-name parser. This issue allows remote authenticated users to read adjacent process memory or trigger a denial of service by sending a malformed TDS RPC request to the TDS port (default 1433).

Recommendations Upgrade Babelfish for PostgreSQL versions 1.0 through 1.5, 2.1 through 2.15, 3.1 through 3.12, 4.0 through 4.8, and 5.1 through 5.4 to versions 4.10, 5.6, 6.1 or later. Upgrade Amazon Aurora PostgreSQL with Babelfish clusters to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later. Restrict network access to the TDS port (default 1433) as a temporary workaround.