CVE-2026-33241

Description

Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service. Version 0.89.3 contains a patch.

PUBLISHED Reserved 2026-03-18 | Published 2026-03-23 | Updated 2026-03-25 | Assigner GitHub_M

Problem types

CWE-770: Allocation of Resources Without Limits or Throttling

Product status

References

github.com/.../salvo/security/advisories/GHSA-pp9r-xg4c-8j4x

github.com/salvo-rs/salvo/releases/tag/v0.89.3

cve.org (CVE-2026-33241)

nvd.nist.gov (CVE-2026-33241)

Download JSON