SpiceDB's WriteRelationships fails silently if payload is too big
Description
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that --write-relationships-max-updates-per-call is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their WriteRelationships call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set --write-relationships-max-updates-per-call to 1000.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/authzed/spicedbGo | < 1.45.2 | 1.45.2 |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-pm3x-jrhh-qcr7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-64529ghsaADVISORY
- github.com/authzed/spicedb/commit/d0cd103a92cc1915636733fb1d1730c2c7f74851ghsaWEB
- github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.