CVE-2026-70633 in TimescaleDB
Summary
by MITRE • 08/07/2026
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray. Attackers with DML access to a compressed hypertable can trigger an unsigned integer wraparound in the reverse iterator bucket index computation, causing a read beyond the end of the bucket array, resulting in a SIGSEGV crash that can be repeatedly triggered on each subsequent reverse-order scan.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability exists within TimescaleDB version 2.29.1 and earlier, where an out-of-bounds read condition occurs in the Gorilla compression algorithm's reverse row iterator implementation. The flaw specifically manifests when processing compressed data stored in hypertables that utilize Gorilla compression. An authenticated attacker with Data Manipulation Language permissions can exploit this vulnerability by inserting a crafted compressed datum containing an internally inconsistent BitArray structure. The security impact stems from the improper handling of unsigned integer arithmetic during reverse iteration operations, where the bucket index computation undergoes an unsigned integer wraparound when processing compressed data in reverse order.
The technical exploitation involves manipulating the compression metadata within the BitArray to create a scenario where the reverse iterator attempts to access memory locations beyond the allocated bucket array boundaries. This occurs because the algorithm computes a bucket index that, due to unsigned integer overflow, becomes a very large positive value instead of remaining within valid array bounds. When subsequent reverse-order scans are performed on the affected compressed hypertable, the system attempts to read from memory addresses that are outside the legitimate data structure boundaries, resulting in segmentation faults and SIGSEGV crashes.
The operational impact of this vulnerability extends beyond simple denial of service as it enables persistent disruption of database operations. Attackers can repeatedly trigger the crash condition with each reverse scan operation on the compromised hypertable, effectively making the affected data inaccessible through normal query operations. This creates a cascading effect where legitimate users cannot perform reverse-order queries against the compressed data, potentially impacting analytics workloads and historical data retrieval processes that depend on such operations.
Mitigation strategies should focus on both immediate patching and operational controls. Organizations must upgrade to TimescaleDB version containing commit 517c13e or apply equivalent fixes that address the unsigned integer wraparound in the reverse iterator bucket index computation. Additionally, access controls should be reviewed to limit DML permissions for compressed hypertables, particularly in multi-tenant environments where untrusted users might have database access. The vulnerability aligns with CWE-129 Input Validation and CWE-190 Integer Overflow or Wraparound categories, while the exploitation pattern corresponds to ATT&CK technique T1499.004 Endpoint Denial of Service through memory corruption mechanisms. Database administrators should implement monitoring for unusual patterns in reverse scan operations on compressed tables and consider implementing data validation checks for compression metadata integrity.