CVE-2025-69255
MEDIUMRustFS 1.0.0-alpha.13-1.0.0-alpha.77 - Denial of Service via Malformed gRPC GetMetrics Request
Title source: llmDescription
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78.
References (2)
Core 2
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/rustfs/rustfs/security/advisories/GHSA-gw2x-q739-qhcr
Patch x_refsource_misc
https://github.com/rustfs/rustfs/commit/eb33e82b56ed11fd12bb39416359d8d60737dc7a
Scores
CVSS v3
4.0
EPSS
0.0028
EPSS Percentile
19.9%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-755
Status
published
Products (2)
crates.io/rustfs
1.0.0-alpha.13 - 1.0.0-alpha.78crates.io
rustfs/rustfs
1.0.0 alpha13 (49 CPE variants)
Published
Jan 07, 2026
Tracked Since
Feb 18, 2026