-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability described is a remote denial of service in the GetMetrics gRPC endpoint of RustFS. The advisory explicitly points to rustfs/src/storage/tonic_service.rs:1775-1782 and the use of .unwrap() on deserialization operations. The provided patch eb33e82b56ed11fd12bb39416359d8d60737dc7a confirms this. The changes in rustfs/src/storage/tonic_service.rs clearly show the replacement of .unwrap() with proper error handling within the get_metrics function of the NodeService struct. When a malformed request is sent, the Deserialize::deserialize function returns an Err, and the subsequent .unwrap() call triggers a panic, crashing the worker thread. The vulnerable function is therefore NodeService::get_metrics.
NodeService::get_metricsrustfs/src/storage/tonic_service.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rustfs | rust | >= 1.0.0-alpha.13, <= 1.0.0-alpha.77 | 1.0.0-alpha.78 |
A Semantic Attack on Google Gemini - Read the Latest Research