CVE-2026-70635 in TimescaleDB
Summary
by MITRE • 08/07/2026
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read before the base of the live offsets array through the VectorAgg single-text hashing strategy, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery depending on build configuration.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability exists within TimescaleDB version 2.29.1 and earlier, where a specific out-of-bounds read condition can be triggered through crafted input data manipulation. The flaw specifically occurs during bulk text dictionary decompression processes when handling Simple8b selector-11 values that are stored in signed int16 Arrow dictionary-index types. This represents a critical security weakness classified under CWE-129 Input Validation and Output Generation, as it bypasses essential index validation checks that should prevent access to invalid memory regions.
The technical implementation of this vulnerability exploits the VectorAgg single-text hashing strategy within compressed hypertable relations, where attackers can manipulate data to cause memory access violations. When an authenticated user with direct DML access to a non-frozen physical compressed hypertable relation supplies maliciously crafted values, the system attempts to read beyond the bounds of the live offsets array. This occurs before reaching the base of the array structure, leading to unpredictable behavior in query execution results and potential system instability.
The operational impact of this vulnerability manifests in several ways depending on the PostgreSQL build configuration and system state. Query-result integrity failures can occur when aggregation operations produce incorrect outputs due to reading invalid memory locations, while backend crashes may result in SIGSEGV signals that force PostgreSQL to terminate unexpectedly. In severe cases, this vulnerability can trigger crash recovery procedures that disrupt service availability and potentially lead to data inconsistency issues within the database system.
The exploitation pathway requires an authenticated user with direct Data Manipulation Language access to a non-frozen compressed hypertable relation, making it less likely to affect casual users but still concerning for environments where multiple database users have elevated privileges. This vulnerability directly relates to ATT&CK technique T1059 Command and Scripting Interpreter and T1496 Resource Hijacking, as it enables attackers to manipulate system resources through crafted data inputs that can cause both denial of service conditions and data integrity issues. The fix implemented in commit 517c13e addresses the core validation issue by strengthening index boundary checks during bulk text dictionary decompression processes.
Organizations should prioritize applying the patched version of TimescaleDB immediately, as this vulnerability represents a significant risk to database stability and data integrity. System administrators should also consider implementing monitoring for unusual query patterns that might indicate exploitation attempts, particularly around compressed hypertable operations. The vulnerability demonstrates the importance of thorough input validation in database systems, especially when handling complex compression algorithms and dictionary-based data structures. Regular security assessments of database configurations and access controls should be conducted to prevent unauthorized users from gaining the necessary privileges to exploit this weakness, as the impact extends beyond simple data corruption to potentially disrupting entire database services through system crashes.