Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/authzed/spicedb
  4. ›
  5. CVE-2025-64529

CVE-2025-64529: SpiceDB WriteRelationships fails silently if payload is too big

November 13, 2025 (updated November 21, 2025)

Users who:

  1. Use the exclusion operator somewhere in their authorization schema.
  2. Have configured their SpiceDB server such that --write-relationships-max-updates-per-call is bigger than 6500.
  3. Issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows.

Users will:

  1. Receive a successful response from their WriteRelationships call, when in reality that call failed.
  2. Receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion.

References

  • github.com/advisories/GHSA-pm3x-jrhh-qcr7
  • github.com/authzed/spicedb
  • github.com/authzed/spicedb/commit/d0cd103a92cc1915636733fb1d1730c2c7f74851
  • github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7
  • nvd.nist.gov/vuln/detail/CVE-2025-64529

Code Behaviors & Features

Detect and mitigate CVE-2025-64529 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 1.45.2

Fixed versions

  • 1.45.2

Solution

Upgrade to version 1.45.2 or above.

Impact 6.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Learn more about CVSS

Weakness

  • CWE-770: Allocation of Resources Without Limits or Throttling

Source file

go/github.com/authzed/spicedb/CVE-2025-64529.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Mon, 24 Nov 2025 00:19:18 +0000.