Vulnerability · Published Nov 10, 2025 · Assigned by GitHub_M
CVE-2025-64529SpiceDB's WriteRelationships fails silently if payload is too big
Low 2.7
In plain English
A low-severity resource allocation without limits in spicedb from authzed. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set `--write-relationships-max-updates-per-call` to `1000`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/authzed/spicedb | 1.45.2 | GHSA-pm3x-jrhh-qcr7 |
| Go | github.com/authzed/spicedb | 1.45.2 | GO-2025-4120 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
References
- https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7 x_refsource_CONFIRM