CVE-2026-70635: Improper Validation of Array Index in timescale timescaledb
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read before the base of the live offsets array through the VectorAgg single-text hashing strategy, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery depending on build configuration.
AI Analysis
Technical Summary
TimescaleDB versions up to 2.29.1 contain an out-of-bounds read vulnerability due to improper validation of array indexes in the handling of Simple8b selector-11 values stored in the signed int16 Arrow dictionary-index type. This bypasses index validation checks during bulk text dictionary decompression. Authenticated attackers with direct DML access to non-frozen physical compressed hypertable relations can trigger an out-of-bounds read before the base of the live offsets array via the VectorAgg single-text hashing strategy. This results in incorrect aggregation output, backend segmentation faults (SIGSEGV), or PostgreSQL crash recovery depending on the build configuration. The issue was fixed in commit 517c13e.
Potential Impact
Exploitation of this vulnerability can lead to incorrect query results, backend crashes (SIGSEGV), or PostgreSQL crash recovery events. The impact requires authenticated attackers with direct DML access to specific compressed hypertables, limiting the attack surface. There are no known exploits in the wild as of the publication date.
Mitigation Recommendations
A fix for this vulnerability is available in TimescaleDB after commit 517c13e (post version 2.29.1). Users should upgrade to a version including this fix to remediate the issue. Patch status is not explicitly confirmed in the provided data, so users should verify the vendor advisory or repository for the fixed version. Until patched, restrict direct DML access to non-frozen physical compressed hypertable relations to trusted users only.
CVE-2026-70635: Improper Validation of Array Index in timescale timescaledb
Description
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read before the base of the live offsets array through the VectorAgg single-text hashing strategy, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery depending on build configuration.
CVSS v4.0
Score 7.1high
Affected software
timescale
timescaledb
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
TimescaleDB versions up to 2.29.1 contain an out-of-bounds read vulnerability due to improper validation of array indexes in the handling of Simple8b selector-11 values stored in the signed int16 Arrow dictionary-index type. This bypasses index validation checks during bulk text dictionary decompression. Authenticated attackers with direct DML access to non-frozen physical compressed hypertable relations can trigger an out-of-bounds read before the base of the live offsets array via the VectorAgg single-text hashing strategy. This results in incorrect aggregation output, backend segmentation faults (SIGSEGV), or PostgreSQL crash recovery depending on the build configuration. The issue was fixed in commit 517c13e.
Potential Impact
Exploitation of this vulnerability can lead to incorrect query results, backend crashes (SIGSEGV), or PostgreSQL crash recovery events. The impact requires authenticated attackers with direct DML access to specific compressed hypertables, limiting the attack surface. There are no known exploits in the wild as of the publication date.
Mitigation Recommendations
A fix for this vulnerability is available in TimescaleDB after commit 517c13e (post version 2.29.1). Users should upgrade to a version including this fix to remediate the issue. Patch status is not explicitly confirmed in the provided data, so users should verify the vendor advisory or repository for the fixed version. Until patched, restrict direct DML access to non-frozen physical compressed hypertable relations to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-04T20:17:18.298Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a75070dbf8831d5395f5c69
Added to database: 08/06/2026, 22:13:33 UTC
Last enriched: 08/14/2026, 16:08:03 UTC
Last updated: 09/21/2026, 22:01:37 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.