EUVD-2026-54183
GHSA-55x3-g2hr-288r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable PostgreSQL requires low-privilege DML authentication; no confidentiality impact; availability is High due to SIGSEGV crash potential; scope unchanged within the database instance.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read before the base of the live offsets array through the VectorAgg single-text hashing strategy, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery depending on build configuration.
AnalysisAI
Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.
Technical ContextAI
TimescaleDB is a PostgreSQL extension that partitions time-series data into 'hypertables' and applies columnar compression using Simple8b integer encoding and Arrow-style dictionary encoding for text columns. Simple8b uses a 4-bit selector to pack multiple values into a 64-bit word; selector-11 encodes a specific bit-width layout. Compressed text columns store values as Arrow dictionary indices, internally typed as signed int16, which are mapped through an offset array during decompression. CWE-125 (Out-of-bounds Read) manifests because a crafted selector-11 value can produce a negative or otherwise invalid signed int16 index that, when used to address the live offsets array in the bulk text dictionary decompression routine, underruns the array base - the index validation check is not applied in this specific code path. This corruption surface is exposed specifically via TimescaleDB's VectorAgg single-text hashing strategy, a vectorized aggregation optimization. The commit diff confirms the fix adds CheckCompressedData boundary assertions throughout the decompression pipeline and introduces a forward-validation pass before reverse iteration in the DeltaDelta decompressor, indicating the validation gap was systemic across multiple decompression algorithms.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - monitor https://github.com/timescale/timescaledb/releases for a version superseding 2.29.1 that includes commit 517c13e. Until a tagged release is available, the primary compensating control is to restrict DML privileges on compressed hypertables to only the minimum required database roles: revoke INSERT, UPDATE, and DELETE on compressed hypertable relations from low-privilege or application-tier accounts that do not require write access, using standard PostgreSQL REVOKE statements. The trade-off is reduced application flexibility and potential need for schema refactoring of permission grants. A secondary option is to disable vectorized aggregation by setting the GUC parameter timescaledb.enable_vectorized_aggregation = off in postgresql.conf or per-session, which removes the VectorAgg code path that reaches the vulnerable decompressor - the trade-off is measurably degraded aggregation throughput on time-series queries. Do not freeze compressed chunks as a mitigation workaround, as the 'non-frozen' condition refers to PostgreSQL's VACUUM FREEZE state and is not a reliable operational control.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today