CVE-2026-55838

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. Every other admin handler in the codebase calls validateadminrequest to...

CVE-2026-55838

CVE-2026-55838 (RustFS) : In versions up to 1.0.0-beta.7, the real-time metrics endpoint /rustfs/admin/v3/metrics is accessible to any valid IAM user, because MetricsHandler skips the admin-request validation that other admin handlers perform. As a result, a user whose policy allows only their ow...

CVE-2026-55838 RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. Every other admin handler in the codebase calls validateadminrequest to...

EUVD-2026-39863

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. Every other admin handler in the codebase calls validateadminrequest to...

PT-2026-52966

Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-beta.8 Description RustFS is a distributed object storage system built in Rust. The real-time metrics endpoint '/rustfs/admin/v3/metrics' is accessible to any valid IAM user, regardless of their assigned policy...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP server metrics instrumentation in Micrometer. An attacker can cause denial of service by sending specially crafted HTTP requests that trigger excessive resource consumption...

Allocation of Resources Without Limits or Throttling

Overview io.micrometer:micrometer-jetty12 is a Micrometer instrumentation for Jetty 12 Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP server metrics instrumentation in Micrometer. An attacker can cause denial of service by sending...

org.http4s:http4s-blaze-server_2.11 (0.15.3), org.http4s:http4s-jetty_2.11 (0.15.3) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.15.3)

org.http4s:http4s-server2.11 MAVEN version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.15.3 - org.http4s:http4s-jetty2.11 0.15.3 -...

org.http4s:http4s-blaze-server_2.11 (0.15.6a), org.http4s:http4s-jetty_2.11 (0.15.6a) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.15.6a)

org.http4s:http4s-server2.11 MAVEN version 0.15.6a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.15.6a - org.http4s:http4s-jetty2.11 0.15.6a -...

org.http4s:http4s-blaze-server_2.11 (0.15.14a), org.http4s:http4s-jetty_2.11 (0.15.14a) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.15.14a)

org.http4s:http4s-server2.11 MAVEN version 0.15.14a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.15.14a - org.http4s:http4s-jetty2.11 0.15.14a -...

org.http4s:http4s-blaze-server_2.11 (0.15.15a), org.http4s:http4s-jetty_2.11 (0.15.15a) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.15.15a)

org.http4s:http4s-server2.11 MAVEN version 0.15.15a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.15.15a - org.http4s:http4s-jetty2.11 0.15.15a -...

com.itv:scalapact-http4s-0-15-0a_2.11 (>=2.2.2, <=2.2.5), org.http4s:http4s-blaze-server_2.11 (0.15.16a) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.15.16a)

org.http4s:http4s-server2.11 MAVEN version 0.15.16a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - com.itv:scalapact-http4s-0-15-0a2.11 =2.2.2, =2.2.5 - org.http4s:http4s-blaze-server2.11 0.15.16a -...

org.http4s:http4s-blaze-server_2.11 (0.16.0-m3), org.http4s:http4s-jetty_2.11 (0.16.0-m3) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.16.0-m3)

org.http4s:http4s-server2.11 MAVEN version 0.16.0-m3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.16.0-m3 - org.http4s:http4s-jetty2.11 0.16.0-m3 -...

org.http4s:http4s-blaze-server_2.11 (0.16.0-rc2), org.http4s:http4s-jetty_2.11 (0.16.0-rc2) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.16.0-rc2)

org.http4s:http4s-server2.11 MAVEN version 0.16.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.16.0-rc2 - org.http4s:http4s-jetty2.11 0.16.0-rc2 -...

org.http4s:http4s-blaze-server_2.11 (0.16.0a-m1), org.http4s:http4s-jetty_2.11 (0.16.0a-m1) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.16.0a-m1)

org.http4s:http4s-server2.11 MAVEN version 0.16.0a-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.16.0a-m1 - org.http4s:http4s-jetty2.11 0.16.0a-m1 -...

org.http4s:http4s-blaze-server_2.11 (0.16.0a-rc1), org.http4s:http4s-jetty_2.11 (0.16.0a-rc1) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.16.0a-rc1)

org.http4s:http4s-server2.11 MAVEN version 0.16.0a-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.16.0a-rc1 - org.http4s:http4s-jetty2.11 0.16.0a-rc1 -...

org.http4s:http4s-blaze-server_2.11 (0.16.1), org.http4s:http4s-jetty_2.11 (0.16.1) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.16.1)

org.http4s:http4s-server2.11 MAVEN version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.16.1 - org.http4s:http4s-jetty2.11 0.16.1 -...

org.http4s:http4s-blaze-server_2.11 (0.16.1a), org.http4s:http4s-jetty_2.11 (0.16.1a) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.16.1a)

org.http4s:http4s-server2.11 MAVEN version 0.16.1a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.16.1a - org.http4s:http4s-jetty2.11 0.16.1a -...

org.http4s:http4s-blaze-server_2.11 (0.16.5), org.http4s:http4s-jetty_2.11 (0.16.5) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.16.5)

org.http4s:http4s-server2.11 MAVEN version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.16.5 - org.http4s:http4s-jetty2.11 0.16.5 -...

org.http4s:http4s-blaze-server_2.11 (0.17.0-rc3), org.http4s:http4s-jetty_2.11 (0.17.0-rc3) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.17.0-rc3)

org.http4s:http4s-server2.11 MAVEN version 0.17.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.17.0-rc3 - org.http4s:http4s-jetty2.11 0.17.0-rc3 -...