{"id":"CVE-2025-69255","title":"RustFS is a distributed object storage system built in Rust","summary":"RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handl…","severity":"medium","cvss":4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-755"],"vendor":"rustfs","product":"rustfs","affected":["rustfs = 1.0.0"],"published":"2026-01-07","updated":"2026-10-14","sourceUpdated":"2026-10-14T19:10:00.297","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-69255","references":[{"url":"https://github.com/rustfs/rustfs/commit/eb33e82b56ed11fd12bb39416359d8d60737dc7a","label":"security-advisories@github.com"},{"url":"https://github.com/rustfs/rustfs/security/advisories/GHSA-gw2x-q739-qhcr","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00337,"epssPercentile":0.25416,"ingestedAt":"2026-10-14T19:49:57.558Z","slug":"CVE-2025-69255","body":"## Overview\n\nRustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78.\n\n## Affected\n\n- `rustfs = 1.0.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":22,"depthScoreParts":{"impact":22,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}