x/vulndb: potential Go vuln in github.com/authzed/spicedb: GHSA-pm3x-jrhh-qcr7

[GoVulnBot]

Advisory GHSA-pm3x-jrhh-qcr7 references a vulnerability in the following Go modules:

Module
github.com/authzed/spicedb

Description:

Impact

Users who:

1. Use the exclusion operator somewhere in their authorization schema.
2. Have configured their SpiceDB server such that --write-relationships-max-updates-per-call is bigger than 6500.
3. Issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows.

Users will:

1. Receive a successful response from their WriteRelationships call, when in reality that call failed.
2. Receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exc...

References:

• ADVISORY: GHSA-pm3x-jrhh-qcr7
• ADVISORY: GHSA-pm3x-jrhh-qcr7
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2025-64529
• FIX: authzed/spicedb@d0cd103

Cross references:

• github.com/authzed/spicedb appears in 10 other report(s):
  • data/reports/GO-2022-0295.yaml (x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2022-21646 #295)
  • data/reports/GO-2023-1723.yaml (x/vulndb: potential Go vuln in github.com/authzed/spicedb: GHSA-cjr9-mr35-7xh6 #1723)
  • data/reports/GO-2023-1871.yaml (x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2023-35930 #1871)
  • data/reports/GO-2023-2166.yaml (x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2023-46255 #2166)
  • data/reports/GO-2024-2597.yaml (x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2024-27101 #2597)
  • data/reports/GO-2024-2716.yaml (x/vulndb: potential Go vuln in github.com/authzed/spicedb: GHSA-j85q-46hg-36p2 #2716)
  • data/reports/GO-2024-2939.yaml (x/vulndb: potential Go vuln in github.com/authzed/spicedb: GHSA-grjv-gjgr-66g2 #2939)
  • data/reports/GO-2024-3131.yaml (x/vulndb: potential Go vuln in github.com/authzed/spicedb: GHSA-jhg6-6qrx-38mr #3131)
  • data/reports/GO-2024-3200.yaml (x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2024-48909 #3200)
  • data/reports/GO-2025-3744.yaml (x/vulndb: potential Go vuln in github.com/authzed/spicedb: GHSA-cwwm-hr97-qfxm #3744)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/authzed/spicedb
      versions:
        - fixed: 1.45.2
      vulnerable_at: 1.45.1
summary: SpiceDB WriteRelationships fails silently if payload is too big in github.com/authzed/spicedb
cves:
    - CVE-2025-64529
ghsas:
    - GHSA-pm3x-jrhh-qcr7
references:
    - advisory: https://github.com/advisories/GHSA-pm3x-jrhh-qcr7
    - advisory: https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-64529
    - fix: https://github.com/authzed/spicedb/commit/d0cd103a92cc1915636733fb1d1730c2c7f74851
source:
    id: GHSA-pm3x-jrhh-qcr7
    created: 2025-11-13T23:01:11.995688708Z
review_status: UNREVIEWED