VEX / RustFS

RustFS

5 statements, issued 2026-11-01.Each one is a scanner finding that is not exploitable in this image, and why.

@id https://quench-works.com/vex/rustfs/2026-11-01

1. CVE-2026-116794

   not affected · component not present
   • russh 0.64.1

   russh 0.64.1 (1.0.4) is listed only because the image ships the tag Cargo.lock at /usr/share/doc/rustfs/Cargo.lock (the prebuilt binary has no cargo-auditable section); the crate is not compiled into /usr/bin/rustfs. russh is optional in the rustfs-protocols crate and enabled only by the sftp feature (tag 1.0.4 commit 46337942d55f3a8e6a97b147ca98d9ea8115555d: crates/protocols/Cargo.toml:179 russh = { workspace = true, optional = true }, crates/protocols/Cargo.toml:109 sftp = [dep:russh, ...]; rustfs/Cargo.toml:60 default = [ftps, webdav, gcs], rustfs/Cargo.toml:66 the only route to rustfs-protocols/sftp). The other russh user, e2e_test, is a test crate outside the release build. Verified 2026-11-01: grep -aoE over the sha256-pinned musl binaries found 383 (1.0.4 x86_64), 379 (1.0.4 aarch64) registry/src crate-version paths and 0 matching russh or pageant, so the russh SSH agent server confirm-constraint handling code is not present. The recipe fails the build if any russh crate path appears in the binary or if the binary stops carrying crate paths.

2. CVE-2026-116696

   not affected · component not present
   • russh 0.64.1

   russh 0.64.1 (1.0.4) is listed only because the image ships the tag Cargo.lock at /usr/share/doc/rustfs/Cargo.lock (the prebuilt binary has no cargo-auditable section); the crate is not compiled into /usr/bin/rustfs. russh is optional in the rustfs-protocols crate and enabled only by the sftp feature (tag 1.0.4 commit 46337942d55f3a8e6a97b147ca98d9ea8115555d: crates/protocols/Cargo.toml:179 russh = { workspace = true, optional = true }, crates/protocols/Cargo.toml:109 sftp = [dep:russh, ...]; rustfs/Cargo.toml:60 default = [ftps, webdav, gcs], rustfs/Cargo.toml:66 the only route to rustfs-protocols/sftp). The other russh user, e2e_test, is a test crate outside the release build. Verified 2026-11-01: grep -aoE over the sha256-pinned musl binaries found 383 (1.0.4 x86_64), 379 (1.0.4 aarch64) registry/src crate-version paths and 0 matching russh or pageant, so the russh SSH agent server constraint parsing code is not present. The recipe fails the build if any russh crate path appears in the binary or if the binary stops carrying crate paths.

3. CVE-2026-116775

   not affected · component not present
   • pageant 0.2.4

   pageant is in the shipped tag Cargo.lock only as a dependency of russh (Cargo.lock 1.0.4: russh 0.64.1 -> pageant; no other package depends on it), and russh is not compiled into /usr/bin/rustfs. russh (the only route to pageant) is listed only because the image ships the tag Cargo.lock at /usr/share/doc/rustfs/Cargo.lock (the prebuilt binary has no cargo-auditable section); the crate is not compiled into /usr/bin/rustfs. russh is optional in the rustfs-protocols crate and enabled only by the sftp feature (tag 1.0.4 commit 46337942d55f3a8e6a97b147ca98d9ea8115555d: crates/protocols/Cargo.toml:179 russh = { workspace = true, optional = true }, crates/protocols/Cargo.toml:109 sftp = [dep:russh, ...]; rustfs/Cargo.toml:60 default = [ftps, webdav, gcs], rustfs/Cargo.toml:66 the only route to rustfs-protocols/sftp). The other russh user, e2e_test, is a test crate outside the release build. Verified 2026-11-01: grep -aoE over the sha256-pinned musl binaries found 383 (1.0.4 x86_64), 379 (1.0.4 aarch64) registry/src crate-version paths and 0 matching russh or pageant, so the pageant PageantStream frame buffering code is not present. The recipe fails the build if any russh crate path appears in the binary or if the binary stops carrying crate paths.

4. CVE-2026-116773

   not affected · component not present
   • russh 0.64.1

   russh 0.64.1 (1.0.4) is listed only because the image ships the tag Cargo.lock at /usr/share/doc/rustfs/Cargo.lock (the prebuilt binary has no cargo-auditable section); the crate is not compiled into /usr/bin/rustfs. russh is optional in the rustfs-protocols crate and enabled only by the sftp feature (tag 1.0.4 commit 46337942d55f3a8e6a97b147ca98d9ea8115555d: crates/protocols/Cargo.toml:179 russh = { workspace = true, optional = true }, crates/protocols/Cargo.toml:109 sftp = [dep:russh, ...]; rustfs/Cargo.toml:60 default = [ftps, webdav, gcs], rustfs/Cargo.toml:66 the only route to rustfs-protocols/sftp). The other russh user, e2e_test, is a test crate outside the release build. Verified 2026-11-01: grep -aoE over the sha256-pinned musl binaries found 383 (1.0.4 x86_64), 379 (1.0.4 aarch64) registry/src crate-version paths and 0 matching russh or pageant, so the russh extension-handling allocation code is not present. The recipe fails the build if any russh crate path appears in the binary or if the binary stops carrying crate paths.

5. CVE-2026-116774

   not affected · component not present
   • russh 0.64.1

   russh 0.64.1 (1.0.4) is listed only because the image ships the tag Cargo.lock at /usr/share/doc/rustfs/Cargo.lock (the prebuilt binary has no cargo-auditable section); the crate is not compiled into /usr/bin/rustfs. russh is optional in the rustfs-protocols crate and enabled only by the sftp feature (tag 1.0.4 commit 46337942d55f3a8e6a97b147ca98d9ea8115555d: crates/protocols/Cargo.toml:179 russh = { workspace = true, optional = true }, crates/protocols/Cargo.toml:109 sftp = [dep:russh, ...]; rustfs/Cargo.toml:60 default = [ftps, webdav, gcs], rustfs/Cargo.toml:66 the only route to rustfs-protocols/sftp). The other russh user, e2e_test, is a test crate outside the release build. Verified 2026-11-01: grep -aoE over the sha256-pinned musl binaries found 383 (1.0.4 x86_64), 379 (1.0.4 aarch64) registry/src crate-version paths and 0 matching russh or pageant, so the russh channel maximum-packet-size handling code is not present. The recipe fails the build if any russh crate path appears in the binary or if the binary stops carrying crate paths.