Description

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML access to a physical compressed relation can store a crafted datum and run a reverse-order scan. With a pass-by-value column type the out-of-bounds Datum is returned to the client as a normal column value, disclosing backend memory including the shared buffer pool, which SQL access control does not cover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-06T22:18:27.857Z",
  "pubdate": "2026-08-06T22:18:27.857Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in TimescaleDB through 2.29.1 within the Dictionary compression reverse row iterator located at tsl/src/compression/algorithms/dictionary.c. The vulnerability arises from an unvalidated 64-bit Simple8b index during reverse-order scans, as the validation check relies on an assertion that is compiled out of release builds. Attackers possessing DML access to a physical compressed relation can store a crafted datum and subsequently execute a reverse-order scan. When targeting a pass-by-value column type, the out-of-bounds Datum is returned directly to the client as a normal column value. This results in the disclosure of sensitive backend memory, including the shared buffer pool, which standard SQL access controls do not cover. The risk implication is significant unauthorized information disclosure of database memory structures. Exploitation requires DML access to manipulate compressed relations and the execution of a reverse-order scan against a pass-by-value column type.",
  "technicalDetails": "The vulnerability resides in the Dictionary compression reverse row iterator implemented in tsl/src/compression/algorithms/dictionary.c within TimescaleDB through 2.29.1. The root cause of the flaw stems from a discrepancy between the forward and reverse traversal paths of the compression algorithm. While the forward path properly validates the decoded index, the reverse path fails to perform this crucial validation because the check is implemented via an assertion. In release builds, assertion statements are compiled out, leaving the 64-bit Simple8b index completely unvalidated and granting the attacker control over the read offset.\nExploitation occurs through a multi-step attack flow. First, an attacker with Data Manipulation Language (DML) access to a physical compressed relation crafts and stores a malicious datum designed to manipulate the unvalidated 64-bit Simple8b index during iteration. Second, the attacker triggers a reverse-order scan on the affected compressed relation. Because the reverse row iterator lacks bounds checking in release builds, it computes an arbitrary read offset controlled by the crafted datum. Finally, if the column type is configured as a pass-by-value type, the resulting out-of-bounds memory contents are treated as a valid Datum and returned directly to the client interface as a standard column value.\nThe affected component is the Dictionary compression reverse row iterator in TimescaleDB versions through 2.29.1. Privilege requirements dictate that the attacker must have DML access to a physical compressed relation to plant the malicious datum. Network exposure is contingent upon the database interface accessibility, but the core vulnerability is an internal memory disclosure flaw triggered via SQL operations. The post-exploitation impact involves severe information disclosure, allowing the unauthorized retrieval of backend memory contents, including data residing within the shared buffer pool that falls outside the boundaries of standard SQL access control mechanisms."
}