CVE-2026-70634

Received Received - Intake

TimescaleDB Out-of-Bounds Read in Dictionary Compression

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML access to a physical compressed relation can store a crafted datum and run a reverse-order scan. With a pass-by-value column type the out-of-bounds Datum is returned to the client as a normal column value, disclosing backend memory including the shared buffer pool, which SQL access control does not cover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-70634

Affected Vendors & Products

Vendor	Product	Version / Range
timescaledb	timescaledb	to 2.29.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

TimescaleDB versions up to 2.29.1 have an out-of-bounds read flaw in the Dictionary compression reverse row iterator. The forward path checks decoded indices, but the reverse path lacks validation in release builds, allowing attacker-controlled 64-bit Simple8b indices. This enables attackers with DML access to store crafted data and trigger reverse scans, potentially exposing backend memory including the shared buffer pool.

Detection Guidance

This vulnerability requires checking for TimescaleDB versions before commit 517c13e. Use commands like 'timescaledb-tune --version' or 'psql -c "SELECT extversion FROM pg_extension WHERE extname = 'timescaledb';"' to verify the installed version. If the version is older than the fixed commit, the system is vulnerable.

Impact Analysis

Attackers with write access to a compressed TimescaleDB table could exploit this to read arbitrary backend memory, including sensitive data in the shared buffer pool. If the column uses pass-by-value types, the leaked memory may be returned as normal column values, bypassing SQL access controls.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches that compromise personal or health information, requiring breach notifications and potential regulatory penalties.

Mitigation Strategies

Upgrade TimescaleDB to a version that includes commit 517c13e or later to fix the out-of-bounds read vulnerability in Dictionary compression.

Hi! I’m here to help you understand CVE-2026-70634. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70