PT-2026-26302 · Salvo · Salvo
Yshing
·
Published
2026-03-19
·
Updated
2026-03-26
·
CVE-2026-33241
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Salvo versions prior to 0.89.3
Description
Salvo, a Rust web framework, is susceptible to denial of service due to unbounded memory allocation during form data parsing. The
form data() method and Extractible macro do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes. The issue affects URL-encoded form data (application/x-www-form-urlencoded), multipart form data (multipart/form-data), and handlers using the #[derive(Extractible)] macro with body sources. The root cause is the FormData::read() implementation prioritizing convenience over safety. The vulnerability can lead to service unavailability, resource exhaustion, and cascading failures in containerized environments. The attack is low cost, requires no authentication, and is difficult to rate-limit. The issue is exploitable on public endpoints and can amplify a small network cost into large memory consumption. Affected endpoints include public API endpoints accepting form data, user registration/profile update handlers, and file upload endpoints using multipart forms.Recommendations
Versions prior to 0.89.3 should be updated to version 0.89.3 or later.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Salvo