{"id":"EUVD-2026-1161","enisaUuid":"78b6e532-dc24-3dd6-9610-e2e79da62a1d","description":"RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78.","datePublished":"Jan 7, 2026, 8:34:25 PM","dateUpdated":"Jan 7, 2026, 9:25:33 PM","baseScore":5.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","references":"https://github.com/rustfs/rustfs/security/advisories/GHSA-gw2x-q739-qhcr\nhttps://github.com/rustfs/rustfs/commit/eb33e82b56ed11fd12bb39416359d8d60737dc7a\n","aliases":"CVE-2025-69255\nGHSA-gw2x-q739-qhcr\n","assigner":"GitHub_M","epss":0.34,"enisaIdProduct":[{"id":"b9cfe935-e6a3-3365-9af6-9ebcba1e9329","product":{"name":"rustfs","vendor":{"name":"rustfs"}},"product_version":"1.0.0-alpha.13, \u003c 1.0.0-alpha.78"}],"enisaIdVendor":[{"id":"e8caa19a-e07d-340e-b58e-351a04b0579a","vendor":{"name":"rustfs"}}],"enisaIdVulnerability":[{"id":"6d79c7c2-6d2d-32fa-aff1-a02696d49c43","vulnerability":{"id":"GHSA-gw2x-q739-qhcr","description":"RustFS gRPC GetMetrics deserialization panic enables remote DoS","datePublished":"Jan 7, 2026, 6:36:23 PM","dateUpdated":"Jan 7, 2026, 9:34:37 PM","baseScore":0.0,"references":"https://github.com/rustfs/rustfs/security/advisories/GHSA-gw2x-q739-qhcr\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-69255\nhttps://github.com/rustfs/rustfs/commit/eb33e82b56ed11fd12bb39416359d8d60737dc7a\nhttps://github.com/rustfs/rustfs\n","enisa_id":"EUVD-2026-1161\n","aliases":"CVE-2025-69255\nGHSA-gw2x-q739-qhcr\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:57:39 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"bc24910a-da7d-343a-9298-5050244275ea","vulnerability":{"id":"CVE-2025-69255","description":"RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78.","datePublished":"Jan 7, 2026, 8:34:25 PM","dateUpdated":"Jan 7, 2026, 9:25:33 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","references":"https://github.com/rustfs/rustfs/security/advisories/GHSA-gw2x-q739-qhcr\nhttps://github.com/rustfs/rustfs/commit/eb33e82b56ed11fd12bb39416359d8d60737dc7a\n","enisa_id":"EUVD-2026-1161\n","assigner":"GitHub_M","epss":0.34,"dataProcessed":"Nov 4, 2026, 7:12:36 AM","vulnerabilityProduct":[{"id":"904cc38f-31e6-3ea0-9cc0-94c1e817aaea","product":{"name":"rustfs","vendor":{"name":"rustfs"}},"product_version":"1.0.0-alpha.13, \u003c 1.0.0-alpha.78"}],"vulnerabilityVendor":[{"id":"097e0a45-6912-3c4a-b0b0-b9c3fa5636f8","vendor":{"name":"rustfs"}}]}}],"enisaIdAdvisory":[]}