EUVD-2026-1161Published

RustFS gRPC GetMetrics deserialization panic enables remote DoS

cve-program · CVE-2025-69255

Published

rustfs

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "rustfs",
                    "product": "rustfs",
                    "versions": [
                        {
                            "version": ">= 1.0.0-alpha.13, < 1.0.0-alpha.78",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-1161

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jan 7, 2026, 8:34:25 PM

dateUpdated: Jan 7, 2026, 9:25:33 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-69255

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-755

Original publisher date fields

published: 2026-01-07T21:16:00.510

lastModified: 2026-10-14T19:10:00.297

66 source CPE criteria · context only

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-gw2x-q739-qhcr

Published

rustfs

crates.io

SEMVER · introduced 1.0.0-alpha.13 → fixed 1.0.0-alpha.78

Original source record · Cite this exact observation · Complete original publisher JSON