TimescaleDB EUVD-2026-54182

TimescaleDB is a PostgreSQL extension implementing custom columnar compression algorithms for time-series data. The Dictionary compression algorithm (tsl/src/compression/algorithms/dictionary.c) uses Simple8b-encoded 64-bit indices to look up values in a dictionary. During forward iteration the decoded index is bounds-checked, but the reverse iterator (used when queries include ORDER BY DESC against compressed chunks) replaced that check with an Assert() macro that is compiled out in release builds. This left the 64-bit Simple8b index unvalidated in the reverse code path, making the resulting read offset into the decompressed buffer fully attacker-controlled-a textbook CWE-125 (Out-of-Bounds Read). The commit diff confirms that the fix replaces Assert() calls with CheckCompressedData() runtime validation throughout the reverse decompression path, adds cross-validation between forward and reverse iterators to detect malformed compressed data, and closes an edge case where a zero-element bit array produced an underflow in bucket counting. A second affected algorithm, DeltaDelta (deltadelta.c), received analogous validation hardening in the same PR.