Description

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read before the base of the live offsets array through the VectorAgg single-text hashing strategy, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery depending on build configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T22:18:28.003Z",
  "pubdate": "2026-08-06T22:18:28.003Z",
  "executiveSummary": "TimescaleDB through version 2.29.1 contains an out-of-bounds read vulnerability residing in its bulk text dictionary decompression mechanism. The flaw allows authenticated attackers with direct DML access to a non-frozen physical compressed hypertable relation to supply a crafted Simple8b selector-11 value. This value is improperly stored within a signed int16 Arrow dictionary-index type, successfully bypassing the implemented index validation checks. Consequently, attackers can trigger an out-of-bounds read operation situated prior to the base of the live offsets array via the VectorAgg single-text hashing strategy. The successful exploitation of this security defect leads directly to query-result integrity failures, backend SIGSEGV signals, or full PostgreSQL database crash recovery sequences, depending heavily on the specific build configuration of the hosting environment. The risk implication centers on operational disruption, denial of service through backend crashes, and potential data corruption or incorrect aggregation outputs affecting analytical queries.",
  "technicalDetails": "The vulnerability stems from inadequate bounds checking and type handling within the bulk text dictionary decompression logic of TimescaleDB. Specifically, the system processes a crafted Simple8b selector-11 value that is subsequently assigned to a signed int16 Arrow dictionary-index data type. Because the index validation checks fail to adequately constrain this signed integer value, the corrupted index bypasses safety verification. During subsequent query execution, the VectorAgg single-text hashing strategy utilizes this unchecked index value, resulting in an out-of-bounds read that reaches memory locations situated before the base of the live offsets array. The attack flow requires an authenticated user who possesses direct DML access to interact with a non-frozen physical compressed hypertable relation. By executing a specially crafted query or data manipulation operation that introduces the malicious Simple8b selector-11 value, the attacker forces the decompression routine to evaluate the invalid signed int16 index. The vulnerable component fails to reject the malformed index, allowing the out-of-bounds memory read to execute during aggregation phases. The resulting impact varies based on memory layout and PostgreSQL build configurations, ranging from the silent return of corrupted aggregation results to immediate backend termination via a segmentation fault (SIGSEGV), which subsequently forces PostgreSQL crash recovery procedures."
}