Skip to content
OpenAdvisories

Package · Wolfi

spicedb

45 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

45 results · Feed

  • Critical 9.8
    CVE-2024-27304 Public exploit

    pgx SQL Injection via Protocol Message Size Overflow

    pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple me…

    jackc pgx kots k3s Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2024-24786

    Infinite loop in JSON unmarshaling in google.golang.org/protobuf

    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown opti…

    google.golang.org/protobuf google.golang.org/protobuf/encoding/protojson google.golang.org/protobuf/internal/encoding/json katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.3
    CVE-2024-27101

    Integer overflow in chunking helper causes dispatching to miss elements or panic

    SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a res…

    authzed spicedb spicedb github.com/authzed/spicedb Wolfi Go
  • Medium 4.2
    CVE-2023-46255

    `SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed

    SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full…

    authzed spicedb spicedb github.com/authzed/spicedb Wolfi Go
  • High 8.7
    CVE-2023-29193

    SpiceDB binding metrics port to untrusted networks and can leak command-line flags

    SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being…

    authzed spicedb spicedb github.com/authzed/spicedb Wolfi Go