CVE-2025-69255: RustFS gRPC GetMetrics deserialization panic enables remote DoS

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-07 · updated 2026-10-14
Weakness: CWE-755

Description

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78.

Affected products

rustfs: 1.0.0-alpha13, 1.0.0-alpha14, 1.0.0-alpha15, 1.0.0-alpha16, 1.0.0-alpha17, 1.0.0-alpha18 (+60)

References

https://github.com/rustfs/rustfs/commit/eb33e82b56ed11fd12bb39416359d8d60737dc7a
https://github.com/rustfs/rustfs/security/advisories/GHSA-gw2x-q739-qhcr

Get alerted when CVE-2025-69255 or the next vulnerability affects your stack