CVE-2026-33241 Details

A denial-of-service vulnerability has been identified in the Salvo web framework for Rust, affecting versions prior to 0.89.3. The issue arises because the framework's form data parsing methods, including 'form_data()' and the 'Extractible' macro, do not impose payload size limits before reading request bodies into memory. This oversight allows attackers to send excessively large payloads, causing out-of-memory conditions that lead to service crashes. The vulnerability is present in handlers that process URL-encoded or multipart form data, as well as those using the 'Extractible' macro with body sources.

Users can upgrade to Salvo version 0.89.3 or later, where this vulnerability has been patched.