TimescaleDB versions up to 2.29.1 contain an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator. Authenticated users with DML privileges on compressed hypertables can store crafted compressed data with an inconsistent BitArray, triggering an unsigned integer wraparound in the reverse iterator bucket index computation. This causes a read beyond the bucket array's end and results in a segmentation fault (SIGSEGV) crash. The issue is addressed in commit 517c13e, which fixes the underlying integer underflow and bounds checking problem.

An attacker with DML access to a compressed hypertable can cause a denial of service by repeatedly triggering a segmentation fault crash during reverse-order scans. This disrupts database availability but does not indicate data disclosure or privilege escalation based on the provided information.

A fix is available and has been committed (commit 517c13e). Users should upgrade to a version including this commit to remediate the vulnerability. No vendor advisory is provided here, so verify the patch status with the official TimescaleDB sources before deployment. Until patched, restrict DML access to trusted users to reduce risk.