Description

An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of service via a malformed TDS RPC request to the TDS port (default 1433). To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-06T19:17:39.593Z",
  "pubdate": "2026-11-06T19:17:39.593Z",
  "executiveSummary": "An out-of-bounds (OOB) read vulnerability exists within the Tabular Data Stream (TDS) Remote Procedure Call (RPC) parser utilized by the Babelfish for PostgreSQL extension.\nThis vulnerability allows a remote authenticated user to perform unauthorized memory reads from adjacent process space or trigger a denial-of-service condition by submitting specially crafted, malformed TDS RPC requests to the TDS port, typically configured on TCP port 1433.\nThe flaw affects a wide range of Babelfish for PostgreSQL versions across multiple release branches (1.x through 5.x) and specifically impacts Amazon Aurora PostgreSQL instances integrated with Babelfish.\nRisk implications include potential information disclosure of sensitive data residing in memory and service availability degradation.\nSuccessful exploitation requires network reachability to the TDS port and a valid authenticated session, limiting the attack vector to users capable of initiating authenticated database interactions.",
  "technicalDetails": "The vulnerability resides in the procedure-name parser logic of the TDS (Tabular Data Stream) protocol implementation within the Babelfish for PostgreSQL extension. The TDS protocol is used by SQL Server clients to communicate with SQL Server instances; in the context of Babelfish, this allows PostgreSQL to act as a SQL Server wire-compatible service. The flaw is triggered when the parser encounters a malformed TDS RPC request that fails to correctly validate the length or structure of the procedure-name parameter.\nThe root cause is an improper bounds check during the parsing of the RPC packet. When a client sends an RPC request, the TDS parser identifies the procedure-name field. If the attacker provides a crafted request where the length field associated with the procedure-name does not align with the actual payload or violates internal parsing constraints, the parser attempts to read memory beyond the allocated buffer boundaries.\nThe attack flow proceeds as follows: First, the attacker establishes a connection to the database instance on the default TDS port (1433). Second, the attacker authenticates, as the vulnerability is accessible to authenticated users. Third, the attacker crafts a malicious TDS RPC packet containing a malformed procedure-name identifier designed to induce an out-of-bounds read. Finally, the server processes this packet; because of the lack of adequate bounds checking, the parser reads memory offsets adjacent to the request buffer.\nImpact of the OOB read includes the potential for an attacker to extract sensitive memory contents, which could include database session information, query results, or other data processed by the Babelfish extension. Furthermore, if the out-of-bounds read access results in a memory access violation or an invalid pointer dereference, the process will crash, leading to a denial-of-service (DoS) condition.\nThe vulnerability affects Babelfish for PostgreSQL versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, and 5.1-5.4. For users of Amazon Aurora PostgreSQL with Babelfish, the flaw is present in deployments utilizing unpatched versions prior to the specified service releases (e.g., 1.5.5, 1.17.2, 2.3.5, 3.8.4, 4.5.5, 5.1.4, 6.0.2, etc.). The lack of input validation on the network-facing RPC parser creates a critical security boundary failure."
}