Uncaught Exception Affecting github.com/authzed/spicedb/internal/graph package, versions >=1.29.3 <1.49.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMAUTHZEDSPICEDBINTERNALGRAPH-15248412
- published8 Feb 2026
- disclosed6 Feb 2026
- creditOleh Konko
Introduced: 6 Feb 2026
CVE NOT AVAILABLE CWE-248 Â (opens in a new tab)How to fix?
Upgrade github.com/authzed/spicedb/internal/graph to version 1.49.1 or higher.
Overview
Affected versions of this package are vulnerable to Uncaught Exception via the Sections component of the Cursor message. An attacker can cause the process to crash by submitting a malformed or tampered cursor token that triggers a panic during parsing. This is only exploitable if the attacker can establish a gRPC connection to the instance and provide a valid token, or if the application passes untrusted cursor tokens through to the instance.
Workaround
This vulnerability can be mitigated by preventing client control of the optional_cursor field in LookupResources calls.