CVE-2025-64529

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64529", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-11-05T21:15:39.401Z", "datePublished": "2025-11-10T22:28:51.589Z", "dateUpdated": "2025-11-12T20:12:52.552Z"}, "containers": {"cna": {"title": "SpiceDB's WriteRelationships fails silently if payload is too big", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7"}], "affected": [{"vendor": "authzed", "product": "spicedb", "versions": [{"version": "< 1.45.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-10T22:28:51.589Z"}, "descriptions": [{"lang": "en", "value": "SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set `--write-relationships-max-updates-per-call` to `1000`."}], "source": {"advisory": "GHSA-pm3x-jrhh-qcr7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T17:34:00.745696Z", "id": "CVE-2025-64529", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:12:52.552Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64529", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T17:34:00.745696Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T17:34:02.695Z"}}], "cna": {"title": "SpiceDB's WriteRelationships fails silently if payload is too big", "source": {"advisory": "GHSA-pm3x-jrhh-qcr7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "authzed", "product": "spicedb", "versions": [{"status": "affected", "version": "< 1.45.2"}]}], "references": [{"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7", "name": "https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set `--write-relationships-max-updates-per-call` to `1000`."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-10T22:28:51.589Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64529", "state": "PUBLISHED", "dateUpdated": "2025-11-12T20:12:52.552Z", "dateReserved": "2025-11-05T21:15:39.401Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-11-10T22:28:51.589Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "spicedb", "vendor": "authzed", "versions": [{"status": "affected", "version": "< 1.45.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E7E6E56-4925-4667-A843-A561545C84A6", "versionEndExcluding": "1.45.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set `--write-relationships-max-updates-per-call` to `1000`."}, {"lang": "es", "value": "SpiceDB es un sistema de base de datos de c\u00f3digo abierto para crear y gestionar permisos de aplicaci\u00f3n cr\u00edticos para la seguridad. En versiones anteriores a la 1.45.2, los usuarios que utilizan el operador de exclusi\u00f3n en alguna parte de su esquema de autorizaci\u00f3n; han configurado su servidor SpiceDB de tal manera que '--write-relationships-max-updates-per-call' es mayor que 6500; y emiten llamadas a WriteRelationships con un n\u00famero suficientemente grande de actualizaciones que hacen que la carga \u00fatil sea mayor de lo que permite su almac\u00e9n de datos; recibir\u00e1n una respuesta exitosa de su llamada a 'WriteRelationships', cuando en realidad esa llamada fall\u00f3, y recibir\u00e1n resultados incorrectos de la verificaci\u00f3n de permisos, si esas relaciones tuvieron que ser le\u00eddas para resolver la relaci\u00f3n que involucra la exclusi\u00f3n. La versi\u00f3n 1.45.2 contiene un parche para el problema. Como soluci\u00f3n alternativa, establezca '--write-relationships-max-updates-per-call' en '1000'."}], "id": "CVE-2025-64529", "lastModified": "2026-06-17T09:54:32.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64529", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T17:34:00.745696Z", "version": "2.0.3"}}]}, "published": "2025-11-10T23:15:42.170", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "spicedb: SpiceDB: Silent WriteRelationships failure leads to incorrect permissions", "id": "2413926", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413926"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-770", "details": ["SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set `--write-relationships-max-updates-per-call` to `1000`.", "A vulnerability has been identified in the WriteRelationships API of SpiceDB, where large relationship-update requests can be silently dropped when the payload exceeds what the underlying datastore permits. This occurs because the server does not always return an error when processing oversized write operations, especially in schemas that use the exclusion operator and in deployments configured with very high per-call write limits. An attacker or misconfigured client could exploit this behavior by sending an excessively large update request, causing the intended relationship changes to be ignored and resulting in incomplete or inconsistent authorization state."], "mitigation": {"lang": "en:us", "value": "~~~\nSet--write-relationships-max-updates-per-call to 1000.\n~~~"}, "name": "CVE-2025-64529", "public_date": "2025-11-10T22:28:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-64529\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-64529\nhttps://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7"], "statement": "This issue is rated Moderate severity, because it affects the behavior of a network-facing API: an attacker or misconfigured client can send an oversized WriteRelationships payload that is silently ignored by the server. The primary impact is to integrity, as expected relationship updates may not be written, with a secondary availability concern where applications may behave incorrectly due to missing authorization state. The flaw does not expose confidential data.\nThe practical impact of this issue depends on specific configuration and schema conditions. Systems are only affected when all of the following are true:\n1. the authorization schema uses the exclusion operator,\n2. the server\u2019s ```--write-relationships-max-updates-per-call``` limit is set above ```6500```, and\n3. clients issue ```WriteRelationships``` calls large enough to exceed the datastore\u2019s allowed payload size.", "threat_severity": "Moderate"}

{"created": "2025-11-12T12:48:15.697763+00:00", "updated": "2025-11-12T12:48:15.697804+00:00", "vendors": ["authzed", "authzed$PRODUCT$spicedb"]}