CVE-2026-70635 is a high severity (CVSS 7.1) out-of-bounds read in TimescaleDB through version 2.29.1. A user with direct write access to a compressed hypertable can cause wrong query results or crash the database backend. The fix is commit 517c13e. Check for a release that contains it.
What's affected
TimescaleDB through 2.29.1, fixed in commit 517c13e, per the record and VulnCheck. Neither source names a fixed release number, so check the TimescaleDB release notes for the first version that includes the commit and pull request 10360.
The weaknesses are CWE-125 (out-of-bounds read) and CWE-129 (improper validation of array index). In bulk text dictionary decompression, a crafted Simple8b selector value is stored in a signed 16 bit dictionary index type and bypasses the index validation. The result is a read before the start of an offsets array through the VectorAgg single-text hashing strategy.
The attacker needs authenticated access with direct DML rights on a non-frozen compressed hypertable relation. Outcomes range from incorrect aggregation output to a backend segmentation fault or PostgreSQL crash recovery, depending on build configuration.
How to check if you're exposed
Check the extension version in each database:
SELECT extversion FROM pg_extension WHERE extname = 'timescaledb';
Then check the installed library version on the server, since the extension version in the catalog can lag behind after a package upgrade until you run ALTER EXTENSION UPDATE.
Next, find who has the exposure: which roles have INSERT, UPDATE or DELETE directly on the physical compressed chunk relations. Most applications write only to the hypertable, not to its internal compressed storage. Review grants with your normal PostgreSQL role inspection.
free in-browser dependency scan is for dependencies in applications, but a PostgreSQL extension is part of your database image, so check container images for the extension package too.
What to do now
- Query pg_extension for the TimescaleDB version in every database.
- Read the TimescaleDB release notes to find the release containing commit 517c13e.
- Upgrade the package, then run ALTER EXTENSION timescaledb UPDATE in each database.
- Review roles with direct write privileges on compressed storage and revoke them where not needed.
- Watch PostgreSQL logs for unexplained backend crashes and crash recovery events.
Why it matters
The class is a failed bounds check. The code validated an index, but the value was stored in a signed type, so a large unsigned input turned negative and slipped past a check written for positive numbers. The read then lands before the start of the array.
An out-of-bounds read is usually less severe than a write, which is reflected in the confidentiality impact being none here. The risk the record focuses on is integrity of results and availability. A database crash takes every application using it down, and silently wrong aggregates can be worse than an obvious failure for reporting workloads.
Quick check
Is there a fixed release?
The record and VulnCheck cite fix commit 517c13e and pull request 10360, but name no release. Check the TimescaleDB release notes for the version that includes it.
Sources
Last reviewed: 18 October 2026.
