Executive brief
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not in github.com/authzed/spicedb
Affected products
- Go github.com/authzed/spicedb
Junglewise Threat Intelligence
CVE-2024-48909: GO-2024-3200 - SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not in github.com/authzed/spic
CVE-2024-48909 · Severity: low · CVSS 3.1 · Published 2024-10-15
Technologies: github.com/authzed/spicedb (Go). Vendors: Go.
Related threats
- SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, Spi
- Authzed SpiceDB improper authorization via cache collision in caveats
- Authzed SpiceDB sensitive information leak in startup logs
- GO-2026-4465 - LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb
- LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic