Integer overflow in chunking helper causes dispatching to miss elements or panicGHSA-h3m7-rqc4-7h9p
HIGHFix: authzed/spicedb@ef443c4GHSA-h3m7-rqc4-7h9p is a high-severity (CVSS 7.3) CWE-190 vulnerability in github.com/authzed/spicedb. A fix is available for github.com/authzed/spicedb — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-h3m7-rqc4-7h9p.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
github.com/authzed/spicedbReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem.
The issue may also lead to a panic rendering the server unavailable
The following API methods are affected:
Impact
Permission checks that are expected to be allowed are instead denied, and lookup subjects will return fewer subjects than expected.
Workarounds
There is no workaround other than making sure that the SpiceDB cluster does not have very wide relations, with the maximum value being the maximum value of an 16-bit unsigned integer
Remediations
- AuthZed Dedicated customers: No action. AuthZed has upgraded all deployments.
- AuthZed Serverless customers: No Action. AuthZed has upgraded all deployments.
- AuthZed Enterprise customers: Upgrade to v1.29.2-hotfix-enterprise.v1.hotfix.v1
- Open Source users: Upgrade to v1.29.2
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/authzed/spicedb | all versions | 1.29.2go get github.com/authzed/spicedb@v1.29.2 |
Affected Products
spicedbauthzedDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/authzed/spicedb, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/authzed/spicedb to 1.29.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-h3m7-rqc4-7h9p is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is GHSA-h3m7-rqc4-7h9p in your dependencies?
Find it across Go, including transitive dependencies.