Description

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray. Attackers with DML access to a compressed hypertable can trigger an unsigned integer wraparound in the reverse iterator bucket index computation, causing a read beyond the end of the bucket array, resulting in a SIGSEGV crash that can be repeatedly triggered on each subsequent reverse-order scan.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-06T22:18:27.710Z",
  "pubdate": "2026-08-06T22:18:27.710Z",
  "executiveSummary": "TimescaleDB through 2.29.1 contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator. The vulnerability allows authenticated attackers with DML access to cause a persistent denial of service affecting the database instance. By storing a crafted compressed datum containing an internally inconsistent BitArray, an attacker can trigger an unsigned integer wraparound during the reverse iterator bucket index computation. This arithmetic anomaly forces the system to read beyond the boundary of the bucket array, resulting in a segmentation fault (SIGSEGV) crash. Because the malicious datum persists within the compressed hypertable, the crash can be repeatedly triggered upon every subsequent reverse-order scan, severely disrupting database availability and operational integrity. The risk is mitigated by restricting DML access to trusted users and applying official code patches.",
  "technicalDetails": "The vulnerability resides within the Gorilla compression reverse row iterator component of TimescaleDB, affecting all software versions through 2.29.1. The root cause is an insecure unsigned integer calculation during the computation of the reverse iterator bucket index. Specifically, when processing compressed data, the system relies on metadata structures such as a BitArray to navigate through chunks of compressed time-series data.\nExploitation requires authenticated access with Data Manipulation Language (DML) privileges to a compressed hypertable within the database. An attacker must construct and store a maliciously crafted compressed datum that features an internally inconsistent BitArray. When a user or system process initiates a reverse-order scan on the affected hypertable, the Gorilla compression reverse row iterator parses this crafted datum.\nDuring the index computation phase, the internal inconsistency in the BitArray causes an unsigned integer wraparound. This unexpected numerical rollover produces an out-of-bounds index value. Consequently, the memory access operation attempts to read data past the legitimate end of the bucket array. This unauthorized memory access violates process boundaries and triggers a SIGSEGV signal, leading to an immediate segmentation fault and termination of the backend process or database service worker.\nBecause the malformed compressed datum is stored persistently in the storage layer, the attack exhibits high repeatability. Every subsequent reverse-order scan that encounters the malicious payload will trigger the identical unsigned integer wraparound and subsequent SIGSEGV crash. This creates a persistent denial of service condition that halts query execution paths relying on reverse iteration over the compromised hypertable."
}