{"id":"CVE-2024-27101","aliases":["GHSA-h3m7-rqc4-7h9p","GO-2024-2597"],"url":"https://o3.security/vulnerability/CVE-2024-27101","summary":"Integer overflow in chunking helper causes dispatching to miss elements or panic","details":"Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem.\n\nThe issue may also lead to a panic rendering the server unavailable\n\nThe following API methods are affected:\n- [CheckPermission](https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.PermissionsService.CheckPermission)\n- [BulkCheckPermission](https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.ExperimentalService.BulkCheckPermission)\n- [LookupSubjects](https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.PermissionsService.LookupSubjects)\n\n#### Impact\n\nPermission checks that are expected to be allowed are instead denied, and lookup subjects will return fewer subjects than expected.\n\n#### Workarounds\n\nThere is no workaround other than making sure that the SpiceDB cluster does not have very wide relations, with the maximum value being the maximum value of an 16-bit unsigned integer\n\n#### Remediations\n\n- AuthZed Dedicated customers: No action. AuthZed has upgraded all deployments.\n- AuthZed Serverless customers: No Action. AuthZed has upgraded all deployments.\n- AuthZed Enterprise customers: Upgrade to [v1.29.2-hotfix-enterprise.v1.hotfix.v1](https://github.com/authzed-enterprise/src/pkgs/container/spicedb-enterprise/182719614?tag=v1.29.2-hotfix-enterprise.v1.hotfix.v1)\n - Open Source users: Upgrade to v1.29.2","published":"2024-03-01T21:01:39.049Z","modified":"2026-08-12T03:51:13.385273993Z","cvss":{"score":7.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","fixedVersion":"1.29.2"}],"fix":{"url":"https://github.com/authzed/spicedb/commit/ef443c442b96909694390324a99849b0407007fe","label":"authzed/spicedb@ef443c4"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27101.json"},{"type":"ADVISORY","url":"https://github.com/authzed/spicedb/security/advisories/GHSA-h3m7-rqc4-7h9p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27101"},{"type":"FIX","url":"https://github.com/authzed/spicedb/commit/ef443c442b96909694390324a99849b0407007fe"},{"type":"PACKAGE","url":"https://github.com/authzed/spicedb"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:13.385273993Z"}}