GitHub Advisoryadvisory · Go

GHSA-pm3x-jrhh-qcr7 SpiceDB WriteRelationships fails silently if payload is too big

LOW Published 2025-11-13 Modified 2026-05-14 Official page ↗
Aliases
CVE-2025-64529
Ecosystem
Go
Packages
github.com/authzed/spicedb
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-770
Reviewed
2025-11-13

Affected packages

• Go github.com/authzed/spicedb: < 1.45.2 → fixed in 1.45.2

Description

Impact Users who 1. use the exclusion operator somewhere in their authorization schema 1. have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500 1. issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows will 1. receive a successful response from their `WriteRelationships` call, when in reality that call failed, 2. receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion Patches Upgrade to v.145.2. Workarounds Set `--write-relationships-max-updates-per-call` to `1000`.

Related

Alias · CVE (1)

  • CVE-2025-64529 SpiceDB is an open source database system for creating and managing security-critical application permissions. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References