Out-of-Bounds Read in TimescaleDB Dictionary Compression

TimescaleDB versions up to and including 2.29.1 contain an out-of-bounds read vulnerability (CVE-2026-70634) located within the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). While the forward decoding path correctly validates index values, the reverse path relies on an assertion that is omitted in production release builds. This oversight leaves the 64-bit Simple8b index unvalidated and the read offset effectively attacker-controlled.

An attacker possessing DML (Data Manipulation Language) access to a physical compressed relation can insert a specifically crafted datum. By subsequently executing a reverse-order scan on the table, the attacker can trigger the out-of-bounds read. If the targeted column utilizes a pass-by-value type, the database engine returns the out-of-bounds memory contents to the client as a legitimate column value. This mechanism bypasses standard SQL access controls, potentially leaking sensitive information stored within the backend memory and the shared buffer pool. The vulnerability is patched in commit 517c13e.

Impact

Successful exploitation allows for the unauthorized disclosure of sensitive server-side memory, including contents of the shared buffer pool. This information leakage could expose credentials, data from other user sessions, or other proprietary information resident in the database backend memory. The vulnerability is restricted to authenticated users with DML privileges on compressed tables, limiting the attack surface to existing database users.

Recommendation

1. Upgrade all TimescaleDB instances to a version containing the fix (commit 517c13e or later).
2. Review database user permissions and restrict DML access to sensitive compressed relations to trusted accounts only.
3. Monitor database logs for unusual reverse-order scan queries or suspicious DML activity on compressed tables if database auditing is available.