GO-2026-4465
NoneCVSS
—
EPSS
—
Published
Feb 17, 2026
CISA due date
—
The record
LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/authzed/spicedb | 0 | 1.49.1 |
| Go | github.com/authzed/spicedb | 1.29.3 | 1.49.1 |
Related vulnerabilities
- GO-2025-4151 SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can… Also affects github.com/authzed/spicedb
- CVE-2025-65111 SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can… Also affects github.com/authzed/spicedb
- GO-2025-4120 SpiceDB WriteRelationships fails silently if payload is too big in… Also affects github.com/authzed/spicedb
- CVE-2025-64529 SpiceDB WriteRelationships fails silently if payload is too big Also affects github.com/authzed/spicedb