CVE-2025-69255
RustFS is a distributed object storage system built in Rust.
Published Jan 7, 2026 · updated Oct 14, 2026 · rustfs rustfs
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78.
Timeline
Detection, updates, and resolution for this record.
Jan 7, 2026 · NIST NVD
Detected
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78.
Oct 14, 2026 · NIST NVD
Updated
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78.
Affected
- cpe rustfs/rustfs1.0.0
Sources
- CVE.orgCVE-2025-69255
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-69255
30-day exploitation probability 0.3%
first.org - NIST NVDCVE-2025-69255
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of ser
nvd.nist.gov