Spicedb
CVE-2025-64529
LOW
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS score of 2.7 (LOW). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. EPSS exploitation probability: 0.08%. |
| Exploit ScenarioDerived | A remote attacker could exhaust system resources through uncontrolled allocation by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
SpiceDB is an open source database system for creating and managing security-critical application permissions. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Set resource limits, implement rate limiting, validate input sizes.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that --write-relationships-max-updates-per-call is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their WriteRelationships call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set --write-relationships-max-updates-per-call to 1000. Affected products include: Authzed Spicedb. Version information: prior to 1.45.2.
Know when Spicedb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that --write-relationships-max-updates-per-call is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their WriteRelationships call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set --write-relationships-max-updates-per-call to 1000.
Executive ViewAI
CVE-2025-64529 is a low-severity vulnerability in versions (CVSS 2.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. A patch is available and can be applied during standard maintenance windows.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for custom
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application per
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical applica
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application per
spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for custom
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical applica
SpiceDB is a graph database purpose-built for storing and evaluating access control data. Rated medium severity (CVSS 4.
A remote code execution vulnerability in SpiceDB (CVSS 3.7). Remediation should follow standard vulnerability management
SpiceDB is an open source database system for creating and managing security-critical application permissions. Rated low
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Rated low severity
GitHub PoC
Exploit-DB