CVE-2026-73288

The record

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.

Affected packages

Related vulnerabilities

• CVE-2026-113730 OGNL is an Object Graph Navigation Library for Java. CWE-693
• CVE-2026-112077 A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. CWE-693
• CVE-2026-88838 A flaw was found in BusyBox's mount utility. CWE-693
• CVE-2026-101899 Axios is a promise-based HTTP client for the browser and Node.js. CWE-693
• CVE-2026-107226 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-693
• CVE-2026-107697 FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that… CWE-693
• CVE-2026-105083 ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in… CWE-693
• CVE-2026-101900 Axios is a promise-based HTTP client for the browser and Node.js. CWE-693