CVE-2025-64529

Description

A vulnerability has been identified in the WriteRelationships API of SpiceDB, where large relationship-update requests can be silently dropped when the payload exceeds what the underlying datastore permits. This occurs because the server does not always return an error when processing oversized write operations, especially in schemas that use the exclusion operator and in deployments configured with very high per-call write limits. An attacker or misconfigured client could exploit this behavior by sending an excessively large update request, causing the intended relationship changes to be ignored and resulting in incomplete or inconsistent authorization state.

Statement

This issue is rated Moderate severity, because it affects the behavior of a network-facing API: an attacker or misconfigured client can send an oversized WriteRelationships payload that is silently ignored by the server. The primary impact is to integrity, as expected relationship updates may not be written, with a secondary availability concern where applications may behave incorrectly due to missing authorization state. The flaw does not expose confidential data.

The practical impact of this issue depends on specific configuration and schema conditions. Systems are only affected when all of the following are true:

  1. the authorization schema uses the exclusion operator,

  2. the server’s --write-relationships-max-updates-per-call limit is set above 6500, and

  3. clients issue WriteRelationships calls large enough to exceed the datastore’s allowed payload size.

Mitigation

Set--write-relationships-max-updates-per-call to 1000.

Understanding the Weakness (CWE)

CWE-770

Availability

Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)

When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.