Timescale TimescaleDB up to 2.29.1 Dictionary Compression Reverse Row Iterator dictionary.c out-of-bounds

Summaryinfo

A vulnerability was found in Timescale TimescaleDB up to 2.29.1 and classified as problematic. Impacted is an unknown function of the file tsl/src/compression/algorithms/dictionary.c of the component Dictionary Compression Reverse Row Iterator. Executing a manipulation can lead to out-of-bounds. This vulnerability appears as CVE-2026-70634. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Timescale TimescaleDB up to 2.29.1. It has been declared as problematic. This vulnerability affects an unknown code of the file tsl/src/compression/algorithms/dictionary.c of the component Dictionary Compression Reverse Row Iterator. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality. CVE summarizes:

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML access to a physical compressed relation can store a crafted datum and run a reverse-order scan. With a pass-by-value column type the out-of-bounds Datum is returned to the client as a normal column value, disclosing backend memory including the shared buffer pool, which SQL access control does not cover.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-70634 since 08/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Applying the patch 517c13e7cc6afa4a7deaa7a5a5a29065e5b5a3 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Timescale

Name

• TimescaleDB

Version

• 2.29.0
• 2.29.1

Website

• Product: https://github.com/timescale/timescaledb/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion