Cloudanix VulnDB

CVE-2025-64529

Medium · 6.5

SpiceDB WriteRelationships fails silently if payload is too big

CVSS

6.5

EPSS

0.3%

Published

Nov 13, 2025

CISA due date

—

The record

Users who: 1. Use the exclusion operator somewhere in their authorization schema. 1. Have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500. 1. Issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows. Users will: 1. Receive a successful response from their `WriteRelationships` call, when in reality that call failed. 2. Receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/authzed/spicedb 0 1.45.2

Related vulnerabilities