CVE-2025-64529: SpiceDB WriteRelationships fails silently if payload is too big
(updated )
Users who
- use the exclusion operator somewhere in their authorization schema
- have configured their SpiceDB server such that
--write-relationships-max-updates-per-callis bigger than 6500 - issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows
will
- receive a successful response from their
WriteRelationshipscall, when in reality that call failed, - receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion
References
Code Behaviors & Features
Detect and mitigate CVE-2025-64529 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →