PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-70634 timescale CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:18:27.857Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML access to a physical compressed relation can store a crafted datum and run a reverse-order scan. With a pass-by-value column type the out-of-bounds Datum is returned to the client as a normal column value, disclosing backend memory including the shared buffer pool, which SQL access control does not cover. Database administrators and security teams managing TimescaleDB instances, especially those with untrusted users having DML access to physical compressed relations, should be aware of this vulnerability and take immediate action to patch or mitigate it. The vulnerability exists in the Dictionary compression reverse row iterator of TimescaleDB, specifically in the file tsl/src/compression/algorithms/dictionary.c. An out-of-bounds read occurs because the reverse path uses an assertion that is compiled out of release builds, leaving the 64-bit Simple8b index unvalidated. This allows an attacker with DML access to a physical compressed relation to store a crafted datum and run a reverse-order scan, potentially disclosing backend memory, including the shared buffer pool. Organizations using TimescaleDB should prioritize patching to prevent potential information disclosure via crafted data storage and reverse-order scans. The CVE details an out-of-bounds read vulnerability in TimescaleDB's Dictionary compression reverse row iterator. Attackers with DML access can exploit this by storing crafted data and running a reverse-order scan, potentially disclosing backend memory. The vulnerability was fixed in commit 517c13e.

Vendor
timescale
Product
timescaledb
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-06
Original CVE updated
2026-08-31
Advisory published
2026-08-06
Advisory updated
2026-08-31

Who should care

Database administrators and security teams managing TimescaleDB instances, especially those with untrusted users having DML access to physical compressed relations, should be aware of this vulnerability and take immediate action to patch or mitigate it.

Technical summary

The vulnerability exists in the Dictionary compression reverse row iterator of TimescaleDB, specifically in the file tsl/src/compression/algorithms/dictionary.c. An out-of-bounds read occurs because the reverse path uses an assertion that is compiled out of release builds, leaving the 64-bit Simple8b index unvalidated. This allows an attacker with DML access to a physical compressed relation to store a crafted datum and run a reverse-order scan, potentially disclosing backend memory, including the shared buffer pool.

Defensive priority

Organizations using TimescaleDB should prioritize patching to prevent potential information disclosure via crafted data storage and reverse-order scans.

Recommended defensive actions

  • Apply the patch from commit 517c13e to update TimescaleDB to a version beyond 2.29.1.
  • Restrict DML access to physical compressed relations to trusted users.
  • Monitor database activity for suspicious reverse-order scans.
  • Implement compensating controls such as SQL access control and memory protection mechanisms.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE details an out-of-bounds read vulnerability in TimescaleDB's Dictionary compression reverse row iterator. Attackers with DML access can exploit this by storing crafted data and running a reverse-order scan, potentially disclosing backend memory. The vulnerability was fixed in commit 517c13e.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-70634 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-70634

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-70634 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-70634

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.