Denial of Service Vulnerability in RustFS Distributed Object Storage System
CVE-2025-69255

5.5MEDIUM

Key Information:

Vendor

Rustfs

Status
Rustfs
Vendor
CVE Published:
7 January 2026

What is CVE-2025-69255?

In RustFS, a distributed object storage system developed in Rust, a vulnerability has been identified in versions 1.0.0-alpha.13 through 1.0.0-alpha.77. Specifically, a malformed gRPC GetMetrics request can lead to a failure in the deserialization process of metric_type/opts, resulting in a panic of the handler thread. This flaw allows for a remote denial of service condition on the metrics endpoint, potentially impacting availability. A patch has been released in version 1.0.0-alpha.78 to address this issue.

Affected Version(s)

rustfs >= 1.0.0-alpha.13, < 1.0.0-alpha.78

References

https://github.com/rustfs/rustfs/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/rustfs/rustfs/commit/eb33e82b56ed11fd1...
x_refsource_MISC

CVSS V4

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.