CVE-2026-33241
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Mar 24, 2026
CISA due date
—
The record
Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service. Version 0.89.3 contains a patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | salvo | 0 | 0.89.3 |
Related vulnerabilities
- GHSA-pp9r-xg4c-8j4x Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing Same vulnerability
- CVE-2026-33242 Salvo is a Rust web framework. Also affects salvo
- GHSA-f842-phm9-p4v4 Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass Also affects salvo
- GHSA-rjf8-2wcw-f6mp Salvo is vulnerable to reflected XSS in the list_html function Also affects salvo
- GHSA-54m3-5fxr-2f3j Salvo is vulnerable to stored XSS in the list_html function by uploading files with… Also affects salvo
- CVE-2026-22256 Salvo is a Rust web backend framework. Also affects salvo
- CVE-2026-22257 Salvo is a Rust web backend framework. Also affects salvo
- CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled… CWE-770