AWS babelfish-for-postgresql vulnerabilities

Latest AWS babelfish-for-postgresql CVEs

Newest publication first

1. CVE-2026-119924 Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser

   Published 2026-11-06

   High·CVSS 7.2 EPSS 0.52%

   An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cau...

2. CVE-2026-119923 Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser

   Published 2026-11-06

   Critical·CVSS 9.3 EPSS 0.62%

   A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database pr...

3. CVE-2026-119922 Babelfish for PostgreSQL Privilege Escalation

   Published 2026-11-03

   High·CVSS 8.7 EPSS 0.55%

   Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend users up...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.