CVE-2026-70633 Details
Description
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray. Attackers with DML access to a compressed hypertable can trigger an unsigned integer wraparound in the reverse iterator bucket index computation, causing a read beyond the end of the bucket array, resulting in a SIGSEGV crash that can be repeatedly triggered on each subsequent reverse-order scan.
A denial-of-service vulnerability has been identified in TimescaleDB versions through 2.29.1. The issue arises from an out-of-bounds read in the Gorilla compression reverse row iterator. Authenticated attackers with DML access to a compressed hypertable can exploit this vulnerability by storing a crafted compressed datum that creates an internal inconsistency in the BitArray. This manipulation triggers an unsigned integer wraparound in the reverse iterator's bucket index calculation, causing a read beyond the bucket array's end. The result is a SIGSEGV crash, which can be repeatedly activated during subsequent reverse-order scans.
Users can upgrade to TimescaleDB version 2.29.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| timescale timescaledb | <= 2.29.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 1, 2026 | Initial Analysis | [email protected] |
| Aug 7, 2026 | CVE Modified | [email protected] |
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |