GitHub Advisoryadvisory · Go
GHSA-pm3x-jrhh-qcr7 SpiceDB WriteRelationships fails silently if payload is too big
LOW
Official page ↗
- Aliases
- CVE-2025-64529
- Ecosystem
- Go
- Packages
- github.com/authzed/spicedb
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weaknesses
- CWE-770
- Reviewed
- 2025-11-13
Affected packages
• Go github.com/authzed/spicedb: < 1.45.2 → fixed in 1.45.2
Description
Impact
Users who
1. use the exclusion operator somewhere in their authorization schema
1. have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500
1. issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows
will
1. receive a successful response from their `WriteRelationships` call, when in reality that call failed,
2. receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion
Patches
Upgrade to v.145.2.
Workarounds
Set `--write-relationships-max-updates-per-call` to `1000`.
Related
Alias · CVE (1)
- CVE-2025-64529 SpiceDB is an open source database system for creating and managing security-critical application permissions. vulnerability
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness