CVE-2026-70633: TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Gorilla Compression Reverse Iterator
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray. Attackers with DML access to a compressed hypertable can trigger an unsigned integer wraparound in the reverse iterator bucket index computation, causing a read beyond the end of the bucket array, resulting in a SIGSEGV crash that can be repeatedly triggered on each subsequent reverse-order scan.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TimescaleDBto a version that resolves this vulnerability.Fixed in 2.29.1Patch commit 517c13e - Compensating control
As a mitigating step until the fix is applied, restrict DML access so that only trusted authenticated users/roles can write crafted compressed datums that could trigger the reverse iterator out-of-bounds read DoS.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70633?
CVE-2026-70633 has a medium severity rating of 6.5.
How do I fix CVE-2026-70633?
To fix CVE-2026-70633, upgrade to TimescaleDB version 2.30.0 or later.
What type of vulnerability is CVE-2026-70633?
CVE-2026-70633 is an out-of-bounds read vulnerability that can lead to denial of service.
Who can exploit CVE-2026-70633?
CVE-2026-70633 can be exploited by authenticated attackers with access to the database.
What component is affected by CVE-2026-70633?
CVE-2026-70633 affects the Gorilla compression reverse row iterator in TimescaleDB.