N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64529

CVE-2025-64529: SpiceDB WriteRelationships fails silently if payload is too big

Impact

Users who:

Use the exclusion operator somewhere in their authorization schema.
Have configured their SpiceDB server such that --write-relationships-max-updates-per-call is bigger than 6500.
Issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows.

Users will:

Receive a successful response from their WriteRelationships call, when in reality that call failed.
Receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion.

Patches

Upgrade to v.145.2.

Workarounds

Set --write-relationships-max-updates-per-call to 1000.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64529

CVE-2025-64529:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/authzed/spicedb	go	< 1.45.2	1.45.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patch d0cd103a92cc1915636733fb1d1730c2c7f74851 reveals that the vulnerability was located in the PostgreSQL datastore implementation of SpiceDB. The root cause was a silent failure in the pgReadWriteTXN.WriteRelationships function. The function performed bulk database writes but did not check for errors after the operation completed using rows.Err(). When a user submitted a WriteRelationships request with a number of updates exceeding PostgreSQL's internal limit of 65,535 parameters, the database would generate an error, but the application would ignore it. This resulted in the relationships not being written to the database, while the API call misleadingly reported success. Consequently, subsequent permission checks could return incorrect results.

The patch rectifies this by adding an explicit error check (if rows.Err() != nil) after the database query. It also introduces a new error handling function, handleWriteError, which specifically identifies the PostgreSQL parameter limit error and translates it into a clear, application-specific WriteOverLimitError. This ensures that such failures are no longer silent and are properly reported to the user.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-64529: SpiceDB WriteRelationships fails silently if payload is too big

Impact

Patches

Workarounds

CVE-2025-64529:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

CVE-2025-64529: SpiceDB WriteRelationships fails silently if payload is too big

Impact

Patches

Workarounds

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI