CVE-2026-70634 in TimescaleDB
Summary
by MITRE • 08/07/2026
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML access to a physical compressed relation can store a crafted datum and run a reverse-order scan. With a pass-by-value column type the out-of-bounds Datum is returned to the client as a normal column value, disclosing backend memory including the shared buffer pool, which SQL access control does not cover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
TimescaleDB versions prior to 2.29.1 contain a critical out-of-bounds read vulnerability in the dictionary compression reverse row iterator implementation located in tsl/src/compression/algorithms/dictionary.c. This flaw exists specifically within the reverse iteration path of the compression algorithm where the system fails to properly validate 64-bit Simple8b index values that are used as read offsets. The forward path of the compression algorithm correctly validates decoded indices, but the reverse path relies on an assertion that is compiled out during release builds, creating a dangerous gap in validation logic.
The technical implementation of this vulnerability stems from how TimescaleDB handles compressed data during reverse scans of physical compressed relations. When a reverse-order scan occurs on a compressed table, the system uses an attacker-controlled 64-bit Simple8b index value as a direct offset for memory access without proper bounds checking. This unvalidated index can be manipulated through crafted data insertion, allowing attackers to specify arbitrary memory offsets within the backend process address space. The vulnerability specifically affects scenarios where DML operations are available to attackers who can store crafted data in compressed relations.
The operational impact of this vulnerability extends beyond simple memory disclosure, as it enables attackers with minimal privileges to access sensitive backend memory structures including the shared buffer pool. This occurs through pass-by-value column types where the out-of-bounds Datum values are returned to clients as normal column data, bypassing standard SQL access controls that typically protect such internal system memory. The disclosed information can include database internal structures, cached data from other queries, and potentially sensitive operational details that should remain isolated within the backend process memory space.
This vulnerability aligns with CWE-125 out-of-bounds read and CVE-2023-46733, representing a classic memory safety issue where improper input validation leads to unauthorized memory access. The ATT&CK framework categorizes this as a privilege escalation technique through data manipulation, where attackers leverage database functionality to gain access to restricted memory areas. The vulnerability demonstrates a clear path from data insertion to information disclosure, making it particularly dangerous for environments where untrusted users have DML access to compressed tables.
The recommended mitigation strategy involves upgrading to TimescaleDB version 2.29.1 or later, which implements proper validation of the Simple8b index values in the reverse iteration path. Additionally, database administrators should implement strict access controls limiting DML privileges on compressed tables and consider disabling compression for sensitive data columns where such vulnerabilities could be exploited. Network segmentation and monitoring for unusual reverse scan patterns can help detect potential exploitation attempts, while regular security assessments should verify that all compression algorithms properly validate input parameters before use in memory operations.
This vulnerability highlights the complexity of modern database systems where compression algorithms must maintain strict memory boundaries even when processing user-supplied data. The design flaw demonstrates how seemingly isolated components like compression algorithms can create attack vectors that bypass traditional database security mechanisms, emphasizing the need for comprehensive security testing across all system components including specialized data processing modules.