CVE-2025-64529
published 2025-11-10CVE-2025-64529: SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the…
PriorityP335medium6.5CVSS 3.1
AVNACLPRNUINSUCNILAL
EPSS
0.24%
15.1th percentile
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set `--write-relationships-max-updates-per-call` to `1000`.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| authzed | spicedb | < 1.45.2 | 1.45.2 |
| github.com | authzed_spicedb | >= 0 < 1.45.2 | 1.45.2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
nvdv4.02.7LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat2.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SpiceDB WriteRelationships fails silently if payload is too big in github.com/authzed/spicedb
osv·2025-11-17
CVE-2025-64529 SpiceDB WriteRelationships fails silently if payload is too big in github.com/authzed/spicedb
SpiceDB WriteRelationships fails silently if payload is too big in github.com/authzed/spicedb
SpiceDB WriteRelationships fails silently if payload is too big in github.com/authzed/spicedb
GHSA
SpiceDB WriteRelationships fails silently if payload is too big
ghsa·2025-11-13
CVE-2025-64529 [LOW] CWE-770 SpiceDB WriteRelationships fails silently if payload is too big
SpiceDB WriteRelationships fails silently if payload is too big
### Impact
Users who:
1. Use the exclusion operator somewhere in their authorization schema.
1. Have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500.
1. Issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows.
Users will:
1. Receive a successful response from their `WriteRelationships` call, when in reality that call failed.
2. Receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion.
### Patches
Upgrade to v.145.2.
### Workarounds
Set `--write-relationships-max-updates-per-call` to `1000`.
OSV
SpiceDB WriteRelationships fails silently if payload is too big
osv·2025-11-13
CVE-2025-64529 [LOW] SpiceDB WriteRelationships fails silently if payload is too big
SpiceDB WriteRelationships fails silently if payload is too big
### Impact
Users who:
1. Use the exclusion operator somewhere in their authorization schema.
1. Have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500.
1. Issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows.
Users will:
1. Receive a successful response from their `WriteRelationships` call, when in reality that call failed.
2. Receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion.
### Patches
Upgrade to v.145.2.
### Workarounds
Set `--write-relationships-max-updates-per-call` to `1000`.
Red Hat
spicedb: SpiceDB: Silent WriteRelationships failure leads to incorrect permissions
vendor_redhat·2025-11-10·CVSS 2.7
CVE-2025-64529 [LOW] CWE-770 spicedb: SpiceDB: Silent WriteRelationships failure leads to incorrect permissions
spicedb: SpiceDB: Silent WriteRelationships failure leads to incorrect permissions
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusio
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-10
Published