CVE-2026-70635

Received Received - Intake

Out-of-Bounds Read in TimescaleDB

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read before the base of the live offsets array through the VectorAgg single-text hashing strategy, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery depending on build configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-70635

Affected Vendors & Products

Vendor	Product	Version / Range
timescaledb	timescaledb	to 2.29.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read in TimescaleDB versions up to 2.29.1. Authenticated attackers can exploit it by providing a specially crafted Simple8b selector-11 value, which bypasses index validation during bulk text dictionary decompression. This occurs because the value is stored in a signed int16 Arrow dictionary-index type. The attack can cause query-result integrity failures, backend crashes, or incorrect aggregation output.

Detection Guidance

Detection requires checking TimescaleDB versions and analyzing query logs for crashes or incorrect aggregation results. No specific commands are provided in the context. Review PostgreSQL logs for SIGSEGV errors or backend crashes related to compressed hypertables.

Impact Analysis

If you use TimescaleDB versions up to 2.29.1, an attacker with direct DML access to a non-frozen physical compressed hypertable relation could trigger this vulnerability. This may lead to incorrect query results, backend crashes (SIGSEGV), or PostgreSQL crash recovery issues, depending on your build configuration. The impact includes data integrity issues and potential service disruption.

Compliance Impact

This vulnerability could lead to query-result integrity failures or backend crashes in TimescaleDB, which may result in unauthorized data access, modification, or deletion. For GDPR, this could violate integrity and confidentiality principles (Article 5), while for HIPAA, it may compromise data integrity and availability under the Security Rule.

Mitigation Strategies

Upgrade TimescaleDB to a version containing commit 517c13e or later. Restrict DML access to non-frozen physical compressed hypertable relations. Monitor for unusual query results or backend crashes.

Hi! I’m here to help you understand CVE-2026-70635. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70