Cloud service vulnerability, severity high
Babelfish for Aurora PostgreSQL TDS memory-safety flaws (CVE-2026-119923, CVE-2026-119924)
Published
AWS disclosed two memory-safety issues in the TDS protocol layer of Babelfish for Aurora PostgreSQL and the Babelfish for PostgreSQL extension. CVE-2026-119923 could let a remote, unauthenticated actor affect the confidentiality, integrity and availability of the database process. CVE-2026-119924 could let an authenticated actor read adjacent process memory or cause a denial of service.
What's affected
- aws rds postgresevery version
What to do
- Upgrade Aurora PostgreSQL clusters with Babelfish enabled to a fixed Aurora PostgreSQL version listed in the AWS bulletin or later.
- Apply any pending maintenance so the cluster is on the latest patch.
- Until upgraded, restrict network access to the TDS port (default 1433) to trusted sources using VPC security groups.
- If you self-host the Babelfish for PostgreSQL extension, move to version 4.10, 5.6 or 6.1.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident aws-babelfish-aurora-postgresql-tds-2026-11References
Notice aws-babelfish-aurora-postgresql-tds-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.