RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/rustfs/rustfs/commit/eb33e82b56ed11fd12bb39416359d8d60737dc7a Patch
- https://github.com/rustfs/rustfs/security/advisories/GHSA-gw2x-q739-qhcr Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.5 · rustfsNVD modified 2026-10-14 19:10
Affected (CPE criteria) 66
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:*cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:*- and 26 more