Out-of-Bounds Read Vulnerability in TimescaleDB by Timescale

CVE-2026-70635

What is CVE-2026-70635?

TimescaleDB versions up to 2.29.1 are susceptible to an out-of-bounds read vulnerability. This issue allows authenticated attackers to induce query-result integrity failures or backend crashes by providing a specifically crafted Simple8b selector-11 value. Such a value, stored in the signed int16 Arrow dictionary-index type, can bypass essential index validation checks during bulk text dictionary decompression. Attackers with direct Data Manipulation Language (DML) access to the compressed hypertable can exploit this vulnerability, leading to an out-of-bounds read that results in incorrect aggregation outputs, backend SIGSEGV errors, or a significant recovery delay for PostgreSQL, depending on the system's build configuration.

References