GHSA-pm3x-jrhh-qcr7

Source

https://github.com/advisories/GHSA-pm3x-jrhh-qcr7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-pm3x-jrhh-qcr7/GHSA-pm3x-jrhh-qcr7.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-pm3x-jrhh-qcr7

Aliases

CVE-2025-64529

Published

2025-11-13T22:58:20Z

Modified

2025-11-13T22:58:20Z

Severity

2.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

SpiceDB WriteRelationships fails silently if payload is too big

Details

Impact

Users who: 1. Use the exclusion operator somewhere in their authorization schema. 1. Have configured their SpiceDB server such that --write-relationships-max-updates-per-call is bigger than 6500. 1. Issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows.

Users will:

Receive a successful response from their WriteRelationships call, when in reality that call failed.
Receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion.

Patches

Upgrade to v.145.2.

Workarounds

Set --write-relationships-max-updates-per-call to 1000.

Database specific

{
    "cwe_ids": [
        "CWE-770"
    ],
    "nvd_published_at": "2025-11-10T23:15:42Z",
    "github_reviewed_at": "2025-11-13T22:58:20Z",
    "severity": "LOW",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/authzed/spicedb

Package

Name: github.com/authzed/spicedb; View open source insights on deps.dev
Purl: pkg:golang/github.com/authzed/spicedb

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.45.2