CVE-2025-69255 RustFS gRPC GetMetrics deserialization panic enables remote DoS
Remote attackers can cause a denial of service in RustFS by sending malformed gRPC GetMetrics requests that trigger a panic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-69255?
CVE-2025-69255 is a medium-severity denial of service vulnerability in rustfs, published on 7 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78.
Weakness: CWE-755
Which versions are affected by CVE-2025-69255?
2 open source packages ship an affected version, including rustfs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rustfs crates.io | From 1.0.0-alpha.13 | 1.0.0-alpha.78 |
rustfs crates.io | From 1.0.0-alpha.13 | 1.0.0-alpha.78 |
Products include Rustfs Rustfs.
How do I fix CVE-2025-69255?
Upgrade rustfs to 1.0.0-alpha.78 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-69255 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-69255 exists.
Other vulnerabilities in rustfs
- CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass
- CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
- CVE-2025-68705 RustFS Path Traversal Vulnerability
- CVE-2026-40937 RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
- CVE-2026-27607 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write
Sources
Also known as GHSA-gw2x-q739-qhcr.