RustFS EUVD-2026-32994

Network reachability to the RustFS admin HTTP interface on a vulnerable build (any release prior to 1.0.0-beta.2) - no credentials, no user interaction, and no non-default configuration are required, because the admin router itself whitelists /profile/cpu and /profile/memory from authentication. The CPU-exhaustion impact specifically requires a build where dump_cpu_pprof_for is compiled in (the advisory cites glibc builds); the information-disclosure impact (absolute filesystem path in the response body) applies wherever the profiling handler is reachable. Real-world exploitation is therefore limited primarily by whether the admin port is exposed beyond the operator network.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H is internally consistent with the description: network-reachable, no authentication, no user interaction, low confidentiality impact (path disclosure), and high availability impact (sustained 60-second CPU burns per request). No EPSS score, KEV listing, or public POC was provided, so the signal is 'no public exploit identified at time of analysis' rather than active exploitation. Practical risk is meaningful for any RustFS deployment whose admin port is reachable from untrusted networks because exploitation is trivial (curl-level), automatable, and amplifiable - a handful of concurrent requests can pin all CPU cores for a minute each. For deployments where the admin interface is firewalled to operators only, real-world risk drops substantially; the 8.8 score should be read in light of that exposure question.

An attacker who can reach a pre-beta.2 RustFS admin port issues a handful of unauthenticated GET requests to /profile/cpu, each forcing the server into a 60-second CPU-profiling loop and returning a response that contains the server's absolute filesystem path. Repeating the request in parallel saturates available cores and degrades or halts object-storage request handling, while the leaked path informs follow-on attacks on adjacent services. Exploitation requires only curl and knowledge of the endpoint, which is documented in the public advisory.