CVE-2024-27101 json
Integer overflow in chunking helper causes dispatching to miss elements or panic
published 2y ago modified 2mo ago also EUVD-2024-0930 , GHSA-h3m7-rqc4-7h9p , GO-2024-2597
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2.
Patch / fix
- go github.com/authzed/spicedb 1.29.2
- authzed spicedb 1.29.2
Is CVE-2024-27101 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/authzed/spicedb | <1.29.2 |
1.29.2 |
Affected products
- authzed spicedb
Classification
- Weakness
-
- CWE-190 Integer Overflow or Wraparound
References
-
github.com
/authzed/spicedb/commit/ef443c442b96909694390324a99849b0407007fe
web, patch
-
github.com
/authzed/spicedb/security/advisories/GHSA-h3m7-rqc4-7h9p
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-27101
advisory
-
github.com
/authzed/spicedb
package
Sources
- CVE List CVE-2024-27101
- GitHub Advisory GHSA-h3m7-rqc4-7h9p
- NVD CVE-2024-27101
- OSV GO-2024-2597
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.