CVE-2026-70635: CWE-129 Improper Validation of Array Index in timescale timescaledb
TimescaleDB versions up to 2.29.1 contain an out-of-bounds read vulnerability due to improper validation of array indexes. Authenticated attackers with direct DML access to certain compressed hypertables can exploit this flaw by supplying crafted input, causing query-result integrity failures, backend crashes, or PostgreSQL crash recovery. The issue is fixed in a commit after version 2.29.1. The vulnerability has a high severity score of 7.1.
AI Analysis
Technical Summary
CVE-2026-70635 is an out-of-bounds read vulnerability in TimescaleDB through version 2.29.1. It arises from improper validation of a Simple8b selector-11 value stored as a signed int16 in the Arrow dictionary-index type, which bypasses index validation during bulk text dictionary decompression. Attackers with authenticated direct DML access to a non-frozen physical compressed hypertable can trigger an out-of-bounds read before the base of the live offsets array via the VectorAgg single-text hashing strategy. This leads to incorrect aggregation results, backend segmentation faults (SIGSEGV), or PostgreSQL crash recovery depending on build configuration. The issue is addressed in a commit identified as 517c13e, which fixes the vulnerability.
Potential Impact
Exploitation allows authenticated users with direct DML access to cause query-result integrity failures or backend crashes, including segmentation faults and PostgreSQL crash recovery events. This can disrupt database availability and data correctness for affected TimescaleDB instances.
Mitigation Recommendations
A fix for this vulnerability is available in TimescaleDB after version 2.29.1, specifically in the commit 517c13e. Users should upgrade to a version that includes this fix. Since no official patch version or advisory is explicitly provided, verify the vendor's latest releases or source repository for the fixed version. Patch status is not yet confirmed in a formal advisory; check the vendor advisory for current remediation guidance.
CVE-2026-70635: CWE-129 Improper Validation of Array Index in timescale timescaledb
Description
TimescaleDB versions up to 2.29.1 contain an out-of-bounds read vulnerability due to improper validation of array indexes. Authenticated attackers with direct DML access to certain compressed hypertables can exploit this flaw by supplying crafted input, causing query-result integrity failures, backend crashes, or PostgreSQL crash recovery. The issue is fixed in a commit after version 2.29.1. The vulnerability has a high severity score of 7.1.
CVSS v4.0
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-70635 is an out-of-bounds read vulnerability in TimescaleDB through version 2.29.1. It arises from improper validation of a Simple8b selector-11 value stored as a signed int16 in the Arrow dictionary-index type, which bypasses index validation during bulk text dictionary decompression. Attackers with authenticated direct DML access to a non-frozen physical compressed hypertable can trigger an out-of-bounds read before the base of the live offsets array via the VectorAgg single-text hashing strategy. This leads to incorrect aggregation results, backend segmentation faults (SIGSEGV), or PostgreSQL crash recovery depending on build configuration. The issue is addressed in a commit identified as 517c13e, which fixes the vulnerability.
Potential Impact
Exploitation allows authenticated users with direct DML access to cause query-result integrity failures or backend crashes, including segmentation faults and PostgreSQL crash recovery events. This can disrupt database availability and data correctness for affected TimescaleDB instances.
Mitigation Recommendations
A fix for this vulnerability is available in TimescaleDB after version 2.29.1, specifically in the commit 517c13e. Users should upgrade to a version that includes this fix. Since no official patch version or advisory is explicitly provided, verify the vendor's latest releases or source repository for the fixed version. Patch status is not yet confirmed in a formal advisory; check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-04T20:17:18.298Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a75070dbf8831d5395f5c69
Added to database: 08/06/2026, 22:13:33 UTC
Last enriched: 08/06/2026, 22:41:20 UTC
Last updated: 08/06/2026, 23:57:02 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.