# CVE-2026-119923

RCE in Babelfish prelogin parser via malformed TDS packet.

- Page: https://www.vulneraibility.com/cve/CVE-2026-119923
- CVSS: 9.3
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.62% (percentile 50.0)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-11-06)
- Weakness: CWE-122
- Published: 2026-11-06

## Affected versions

- Amazon Amazon Aurora PostgreSQL with Babelfish: affected >= 1.0.0 and < 1.5.5; >= 1.6.0 and < 1.17.2; >= 2.0.0 and < 2.3.5; >= 2.4.0 and < 2.12.4; >= 2.13.0 and < 2.13.3; >= 2.14.0 and < 2.14.2; >= 2.15.0 and < 2.15.2; >= 2.16.0 and < 2.16.1; >= 3.0.0 and < 3.8.4; >= 3.9.0 and < 3.9.4; >= 3.10.0 and < 3.10.3; >= 3.11.0 and < 3.11.2; >= 3.12.0 and < 3.12.2; >= 3.13.0 and < 3.13.1; >= 4.0.0 and < 4.5.5; >= 4.6.0 and < 4.6.3; >= 4.7.0 and < 4.7.2; >= 4.8.0 and < 4.8.2; >= 4.9.0 and < 4.9.1; >= 5.0.0 and < 5.1.4; >= 5.2.0 and < 5.2.3; >= 5.3.0 and < 5.3.2; >= 5.4.0 and < 5.4.2; 5.5.0; >= 6.0.0 and < 6.0.2
- AWS babelfish-for-postgresql: affected >= 1.0 and <= 1.5; >= 2.1 and <= 2.15; >= 3.1 and <= 3.12; >= 4.0 and <= 4.8; >= 5.1 and <= 5.4

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote code execution as the database process user via malformed TDS prelogin packet to the TDS port (default 1433).

## Action

Immediate action required

## Recommendation

Upgrade Babelfish/Aurora to vendor fixed versions or block TDS (1433) until patched.

## References

- [patch] https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14
- [patch] https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10
- [patch] https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4
- [advisory] https://aws.amazon.com/security/security-bulletins/2026-166-aws/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.