-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/authzed/spicedb | go | < 1.29.2 | 1.29.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from integer overflow in chunking logic. The commit diff shows the function ForEachChunkUntil was modified to change dataLength and chunk indices from uint16 to uint64. The original implementation would overflow when handling >65535 elements (max uint16 value), causing incorrect chunk calculations. This directly impacts security-sensitive dispatch methods (CheckPermission, etc.) that rely on complete chunk processing. The added tests in dispatch_test.go and chunking_test.go specifically validate behavior with math.MaxUint16+1 elements, confirming the overflow scenario was the root cause.
Ongoing coverage of React2Shell