CVE-2026-70634

Name of the Vulnerable Software and Affected Versions TimescaleDB versions prior to 2.29.1

Description An out-of-bounds read exists in the Dictionary compression reverse row iterator within the tsl/src/compression/algorithms/dictionary.c file. While the forward path validates the decoded index, the reverse path relies on an assertion that is removed from release builds, leaving the 64-bit Simple8b index unvalidated. This allows an attacker with DML (Data Manipulation Language) access to a physical compressed relation to store a crafted datum and execute a reverse-order scan. When using a pass-by-value column type, the out-of-bounds Datum is returned to the client as a standard column value, potentially disclosing backend memory, including the shared buffer pool, bypassing SQL access controls.

Recommendations Update TimescaleDB to a version that includes the fix implemented in commit 517c13e.