CVE Explorer
CVE-2025-64529
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successf
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"spicedb","vendor":"authzed","versions":[{"status":"affected","version":"< 1.45.2"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:d6af670b44161281abed62a9f202d2ff9f8cdd64a4ba1b4e044c497d38615296 · sha256:69ab6a17b0b3b4d7… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":2.7,"baseSeverity":"LOW","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:d6af670b44161281abed62a9f202d2ff9f8cdd64a4ba1b4e044c497d38615296 · sha256:69ab6a17b0b3b4d7… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-770","description":"CWE-770: Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:d6af670b44161281abed62a9f202d2ff9f8cdd64a4ba1b4e044c497d38615296 · sha256:69ab6a17b0b3b4d7… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7","tags":["x_refsource_CONFIRM"],"url":"https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d6af670b44161281abed62a9f202d2ff9f8cdd64a4ba1b4e044c497d38615296 · sha256:69ab6a17b0b3b4d7… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.