CVE-2026-70634

{"id": "CVE-2026-70634", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70634", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T16:12:00.366614Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/timescale/timescaledb", "vendor": "timescale", "product": "timescaledb", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.29.1"}, {"status": "unaffected", "version": "517c13e7cc6afadb4a7deaa7a5a5a29065e5b5a3", "versionType": "git"}], "packageURL": "pkg:github/timescale/timescaledb", "defaultStatus": "unaffected"}]}], "published": "2026-08-06T22:18:27.857", "references": [{"url": "https://github.com/timescale/timescaledb/commit/517c13e7cc6afadb4a7deaa7a5a5a29065e5b5a3", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/timescale/timescaledb/pull/10360", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/timescaledb-out-of-bounds-read-information-disclosure-via-dictionary-compression-reverse-iterator", "tags": ["Patch", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-129"}]}], "descriptions": [{"lang": "en", "value": "TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML access to a physical compressed relation can store a crafted datum and run a reverse-order scan. With a pass-by-value column type the out-of-bounds Datum is returned to the client as a normal column value, disclosing backend memory including the shared buffer pool, which SQL access control does not cover."}, {"lang": "es", "value": "TimescaleDB hasta la versi\u00f3n 2.29.1, corregido en el commit 517c13e, contiene una lectura fuera de l\u00edmites en el iterador de filas inverso de la compresi\u00f3n de diccionario (tsl/src/compression/algorithms/dictionary.c). La ruta de avance valida el \u00edndice decodificado; la ruta inversa utiliza una aserci\u00f3n compilada fuera de las compilaciones de lanzamiento, dejando el \u00edndice Simple8b de 64 bits sin validar y el desplazamiento de lectura controlado por el atacante. Los atacantes con acceso DML a una relaci\u00f3n comprimida f\u00edsica pueden almacenar un dato manipulado y ejecutar una exploraci\u00f3n en orden inverso. Con un tipo de columna de paso por valor, el Datum fuera de l\u00edmites se devuelve al cliente como un valor de columna normal, revelando memoria del backend, incluido el pool de b\u00faferes compartidos, que el control de acceso de SQL no cubre."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:timescale:timescaledb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50B927DF-2978-4284-AAC9-4BB7619DC041", "versionEndIncluding": "2.29.1"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}