EUVD-2026-54179
GHSA-9f3p-792w-mhv3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated network attacker (PR:L, AV:N) crashes the PostgreSQL backend (A:H) with no confidentiality or integrity impact and no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray. Attackers with DML access to a compressed hypertable can trigger an unsigned integer wraparound in the reverse iterator bucket index computation, causing a read beyond the end of the bucket array, resulting in a SIGSEGV crash that can be repeatedly triggered on each subsequent reverse-order scan.
AnalysisAI
Denial of service in TimescaleDB through 2.29.1 allows authenticated database users holding DML privileges on a compressed hypertable to permanently crash the PostgreSQL backend on any reverse-order scan. The root cause is an unsigned integer underflow in the Gorilla compression reverse row iterator's bucket index computation when decompressing a crafted BitArray with zero elements, triggering a SIGSEGV that recurs on every subsequent reverse scan of the affected chunk until the malicious datum is removed or the database is patched. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the persistence of the malicious datum and low attack complexity make this a high-priority patch for any TimescaleDB deployment exposing DML access to untrusted users.
Technical ContextAI
TimescaleDB is a PostgreSQL extension that compresses time-series data stored in hypertable chunks using algorithms including Gorilla (floating-point) and DeltaDelta (integer delta-of-delta encoding). Compressed data is stored in BitArrays - arrays of 64-bit integer buckets. The reverse iterator function bit_array_iterator_init_rev initializes its current_bucket index by computing num_elements - 1 without first guarding against num_elements == 0. Because the bucket index is an unsigned integer type, this underflow wraps to UINT64_MAX, directing the subsequent read far beyond the end of the allocated bucket array. CWE-125 (Out-of-bounds Read) is the correct root cause class. The fix in commit 517c13e (PR #10360) adds zero-element guards in both bit_array_num_buckets and bit_array_iterator_init_rev, and introduces CheckCompressedData validation macros throughout the DeltaDelta decompressor to catch further inconsistencies before they reach memory-access code. The reporter @mdisec is credited with identifying compressed data validation deficiencies.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed. Apply commit 517c13e directly from https://github.com/timescale/timescaledb/commit/517c13e7cc6afadb4a7deaa7a5a5a29065e5b5a3, or upgrade to the first TimescaleDB release that incorporates PR #10360 once it is tagged. Before patching, the most effective compensating control is revoking INSERT and UPDATE privileges on compressed hypertables from any non-administrative or untrusted database users - this blocks the insertion of malicious compressed datums but will disrupt normal data ingestion pipelines for those users. A second control is to temporarily disable hypertable compression (ALTER TABLE ... SET (timescaledb.compress = false)) on tables accessible to untrusted accounts, converting compressed chunks to uncompressed form at the cost of increased storage and reduced query performance. Monitoring PostgreSQL logs for repeated backend SIGSEGV crashes on the same hypertable serves as an indicator of active exploitation. Any existing malicious datum must be identified and deleted before reverse-order scans on the affected chunk will succeed.
More in Timescaledb
View allArbitrary code execution in TimescaleDB 2.23.0 through 2.25.1 allows local authenticated users to execute malicious func
TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through
Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation. Rated high
Out-of-bounds read in TimescaleDB's Dictionary compression reverse row iterator (versions through 2.29.1) allows an auth
Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML acces
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today