CVE-2024-27101
criticalpriority · track · 36EPSS 0.005 · 39 %ileEUUSEPSS · scored 2026-10-27
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.3–9.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-h3m7-rqc4-7h9pInteger overflow in chunking helper causes dispatching to miss elements or panic2024-03-01ghsa · osvUS
Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The issue may also lead to a panic rendering the server unavailable The following API methods are affected: - [CheckPermission](https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.PermissionsService.CheckPermission) - [BulkCheckPermission](https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.ExperimentalService.BulkCheckPermission) - [LookupSubjects](https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.PermissionsService.LookupSubjects) #### Impact Permission checks that are expected to be allowed are instead denied, and lookup subjects will return fewer subjects than expected. #### Workarounds There is no workaround other than making sure that the SpiceDB cluster does not have very wide relations, with the maximum value being the maximum value of an 16-bit unsigned integer #### Remediations - AuthZed Dedicated customers: No action. AuthZed has upgraded all deployments. - AuthZed Serverless customers: No Action. AuthZed has upgraded all deployments. - AuthZed Enterprise customers: Upgrade to [v1.29.2-hotfix-enterprise.v1.hotfix.v1](https://github.com/authzed-enterprise/src/pkgs/container/spicedb-enterprise/182719614?tag=v1.29.2-hotfix-enterprise.v1.hotfix.v1) - Open Source users: Upgrade to v1.29.2
- GO-2024-2597Integer overflow in chunking helper causes dispatching to miss elements or panic in github.com/authzed/spicedb2024-06-04vendor · osvUS
Integer overflow in chunking helper causes dispatching to miss elements or panic in github.com/authzed/spicedb
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-27101/cnnvd
- https://github.com/authzed/spicedb/commit/ef443c442b96909694390324a99849b0407007fecnnvd
- https://github.com/authzed/spicedb/security/advisories/GHSA-h3m7-rqc4-7h9pcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-27101cnnvd
- https://github.com/authzed/spicedb/commit/ef443c442b96909694390324a99849b0407007feenisa_euvd
- https://github.com/authzed/spicedb/security/advisories/GHSA-h3m7-rqc4-7h9penisa_euvd
- https://github.com/authzed/spicedb/commit/ef443c442b96909694390324a99849b0407007fePatchnvd
- https://github.com/authzed/spicedb/security/advisories/GHSA-h3m7-rqc4-7h9pVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan