CVE-2025-64529
mediumpriority · track · 26EPSS 0.003 · 18 %ileEUUSEPSS · scored 2026-10-27
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set `--write-relationships-max-updates-per-call` to `1000`.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.7–6.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-pm3x-jrhh-qcr7SpiceDB WriteRelationships fails silently if payload is too big2025-11-13ghsa · osvUS
### Impact Users who 1. use the exclusion operator somewhere in their authorization schema 1. have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500 1. issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows will 1. receive a successful response from their `WriteRelationships` call, when in reality that call failed, 2. receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion ### Patches Upgrade to v.145.2. ### Workarounds Set `--write-relationships-max-updates-per-call` to `1000`.
- GO-2025-4120SpiceDB WriteRelationships fails silently if payload is too big in github.com/authzed/spicedb2025-11-17vendor · osvUS
SpiceDB WriteRelationships fails silently if payload is too big in github.com/authzed/spicedb
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://github.com/authzed/spicedb/releasesPatchcnnvd
- https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7cnnvd
- https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7enisa_euvd
- https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7PatchVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan