CVE-2024-27101: Integer overflow in chunking helper causes dispatching to miss elements or panic in github.com/authzed/spicedb
Summary
CVE-2024-27101: Integer overflow in chunking helper causes dispatching to miss elements or panic. Affects github.com/authzed/spicedb versions < 1.29.2. Fixed in 1.29.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/authzed/spicedb is an open-source Go package that provides a distributed database for managing permissions and access control. It is commonly used in applications that require fine-grained authorization capabilities. This package allows users to define schemas and perform permission checks and subject lookups. However, a vulnerability has been discovered in the package that can lead to incorrect permission checks and subject lookup results.
Vulnerability Detail
The vulnerability in github.com/authzed/spicedb is an integer overflow in the chunking helper. When a resource being checked has more than 65535 relationships for the same resource and subject type, the chunking helper fails to properly dispatch elements, resulting in permission checks being denied when they should be allowed. Additionally, this issue can cause the server to panic, rendering it unavailable. The impacted API methods include CheckPermission, BulkCheckPermission, and LookupSubjects. The consequences of this vulnerability are that permission checks that should be allowed are denied, and subject lookups return fewer subjects than expected.
How To Fix
Latest published version: v1.57.0 as of 23 Oct 2026
go get github.com/authzed/spicedb@v1.57.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.29.2
This is the first release that contains the fix.
go get github.com/authzed/spicedb@v1.29.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability other than ensuring that the SpiceDB cluster does not have more than 65535 relationships for the same resource and subject type.
Conclusion
In conclusion, the vulnerability in github.com/authzed/spicedb can lead to incorrect permission checks and subject lookup results. It is recommended to upgrade to the latest version of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/authzed/spicedb →
FAQ
The impact of this vulnerability is that permission checks that should be allowed are denied, and subject lookups return fewer subjects than expected.
The affected API methods are CheckPermission, BulkCheckPermission, and LookupSubjects.
The recommended fix is to upgrade to version 1.29.2 of github.com/authzed/spicedb.
No, AuthZed Dedicated and Serverless customers do not need to take any action as the deployments have already been upgraded.
There is no known workaround other than ensuring that the SpiceDB cluster does not have more than 65535 relationships for the same resource and subject type.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/authzed/spicedb.
