- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 15 · 3 high, 2 medium, 10 low
- Registry
- pkg.go.dev
Advisories 15
- CVE-2026-55866Low 3.7
SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected
Affected: from 1.34.0, fixed in 1.54.0.
- CVE-2026-46668Low 2.3
SpiceDB: Caveat structures with nested lists can result in improper cache reuse
Affected: from 1.15.0, fixed in 1.52.0.
- CVE-2026-40091Medium 6.0
SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
Affected: from 1.49.0, fixed in 1.51.1.
- CVE-2025-65111Low 2.9
SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
Affected: fixed in 1.47.1.
- CVE-2025-64529Low 2.7
SpiceDB's WriteRelationships fails silently if payload is too big
Affected: fixed in 1.45.2.
- CVE-2025-49011Low 3.7
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
Affected: fixed in 1.44.2.
- CVE-2024-48909Low 2.0
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not
Affected: from 1.35.0, fixed in 1.37.1.
- CVE-2024-46989Low 3.7
Multiple caveats on resources of the same type can result in no permission when permission is expected
Affected: fixed in 1.35.3.
- CVE-2024-38361Low 3.7
Permissions processing error in spacedb
Affected: fixed in 1.33.1.
- CVE-2024-32001Low 2.2
SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used
Affected: fixed in 1.30.1.
- CVE-2024-27101High 7.3
Integer overflow in chunking helper causes dispatching to miss elements or panic
Affected: fixed in 1.29.2.
- CVE-2023-46255Medium 4.2
`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed
Affected: fixed in 1.27.0-rc1.
- CVE-2023-35930Low 3.7
LookupResources may return partial results in spicedb
Affected: from 1.22.0, fixed in 1.22.2; from 1.22.0, fixed in 1.22.2.
- CVE-2023-29193High 8.7
SpiceDB binding metrics port to untrusted networks and can leak command-line flags
Affected: fixed in 1.19.1.
- CVE-2022-21646High 8.1
Lookup operations do not take into account wildcards in SpiceDB
Affected: from 1.3.0, fixed in 1.4.0; from 1.3.0, fixed in 1.4.0.