Timescale TimescaleDB up to 2.29.1 Bulk Text Dictionary Decompression out-of-bounds

Summaryinfo

A vulnerability identified as critical has been detected in Timescale TimescaleDB up to 2.29.1. Affected by this issue is some unknown functionality of the component Bulk Text Dictionary Decompression. Performing a manipulation results in out-of-bounds. This vulnerability is identified as CVE-2026-70635. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Timescale TimescaleDB up to 2.29.1. It has been classified as critical. This affects some unknown functionality of the component Bulk Text Dictionary Decompression. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read before the base of the live offsets array through the VectorAgg single-text hashing strategy, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery depending on build configuration.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-70635 since 08/04/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available.

Applying the patch 517c13e7cc6afa4a7deaa7a5a5a29065e5b5a3 is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Timescale

Name

• TimescaleDB

Version

• 2.29.0
• 2.29.1

Website

• Product: https://github.com/timescale/timescaledb/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion