PT-2026-1935 · Rustfs · Rustfs

Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-69255

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.13 through 1.0.0-alpha.77

Description RustFS is a distributed object storage system built in Rust. A malformed gRPC GetMetrics request can cause the get metrics function to fail during deserialization of metric type/opts, leading to a panic in the handler thread. This can result in a remote denial of service affecting the metrics endpoint.

Recommendations Update to version 1.0.0-alpha.78 or later.

Exploit

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2025-69255

GHSA-GW2X-Q739-QHCR

Affected Products

Rustfs

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69255.json · Exploit
• https://github.com/rustfs/rustfs/commit/eb33e82b56ed11fd12bb39416359d8d60737dc7a · Patch
• https://github.com/rustfs/rustfs/security/advisories/GHSA-gw2x-q739-qhcr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69255 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69255 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gw2x-q739-qhcr · Vendor Advisory
• https://github.com/rustfs/rustfs · Note
• https://twitter.com/CVEnew/status/2009020521263059207 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009037328187076659 · Twitter Post