CVE-2026-70633: Integer Underflow (Wrap or Wraparound) in timescale timescaledb
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray. Attackers with DML access to a compressed hypertable can trigger an unsigned integer wraparound in the reverse iterator bucket index computation, causing a read beyond the end of the bucket array, resulting in a SIGSEGV crash that can be repeatedly triggered on each subsequent reverse-order scan.
AI Analysis
Technical Summary
TimescaleDB versions up to 2.29.1 contain an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator. Authenticated attackers with DML privileges on a compressed hypertable can store specially crafted compressed data with an inconsistent BitArray. This triggers an unsigned integer wraparound in the reverse iterator bucket index calculation, causing a read beyond the bucket array bounds and resulting in a SIGSEGV crash. This crash can be repeatedly triggered on subsequent reverse-order scans. The vulnerability is addressed in commit 517c13e.
Potential Impact
An attacker with data manipulation privileges on a compressed hypertable can cause a denial of service by crashing the TimescaleDB process through a segmentation fault. This disrupts database availability but does not indicate data disclosure or privilege escalation from the provided information.
Mitigation Recommendations
No official patch or vendor advisory is currently provided. The vulnerability is fixed in commit 517c13e, so upgrading to a version including this fix is recommended once available. Until then, restrict DML access to trusted users and avoid using reverse-order scans on compressed hypertables if possible. Monitor vendor channels for an official patch release.
CVE-2026-70633: Integer Underflow (Wrap or Wraparound) in timescale timescaledb
Description
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray. Attackers with DML access to a compressed hypertable can trigger an unsigned integer wraparound in the reverse iterator bucket index computation, causing a read beyond the end of the bucket array, resulting in a SIGSEGV crash that can be repeatedly triggered on each subsequent reverse-order scan.
CVSS v4.0
Score 7.1high
Affected software
timescale
timescaledb
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
TimescaleDB versions up to 2.29.1 contain an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator. Authenticated attackers with DML privileges on a compressed hypertable can store specially crafted compressed data with an inconsistent BitArray. This triggers an unsigned integer wraparound in the reverse iterator bucket index calculation, causing a read beyond the bucket array bounds and resulting in a SIGSEGV crash. This crash can be repeatedly triggered on subsequent reverse-order scans. The vulnerability is addressed in commit 517c13e.
Potential Impact
An attacker with data manipulation privileges on a compressed hypertable can cause a denial of service by crashing the TimescaleDB process through a segmentation fault. This disrupts database availability but does not indicate data disclosure or privilege escalation from the provided information.
Mitigation Recommendations
No official patch or vendor advisory is currently provided. The vulnerability is fixed in commit 517c13e, so upgrading to a version including this fix is recommended once available. Until then, restrict DML access to trusted users and avoid using reverse-order scans on compressed hypertables if possible. Monitor vendor channels for an official patch release.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-04T20:17:18.297Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a75070dbf8831d5395f5c61
Added to database: 08/06/2026, 22:13:33 UTC
Last enriched: 08/14/2026, 16:07:32 UTC
Last updated: 09/21/2026, 22:01:37 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.