CVE-2024-27101 - CVE House
Back to Database
Status published High CVE-2024-27101

Integer overflow in chunking helper causes dispatching to miss elements or panic

Vulnerability Description

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-27101

Credits & Attribution

No credits recorded in the NVD database.

References

More from authzed

View All →
CVE-2025-65111
SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
Low 2.9
CVE-2025-64529
SpiceDB's WriteRelationships fails silently if payload is too big
Low 2.7
CVE-2025-49011
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
Low 3.7
CVE-2024-48909
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not
Low 2
CVE-2024-46989
Multiple caveats on resources of the same type can result in no permission when permission is expected
Low 3.7

Affected Vendor

Affected Software

spicedb
Vulnerable Versions:
< 1.29.2

Timeline

Official Publish: March 1st, 2024
Last Modified: April 16th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H

Weaknesses (CWE)

CWE-190

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1499 Endpoint Denial of Service
Impact