CVE-2026-33241 in salvo-rs salvo
Sumário (Inglês)
Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service. Version 0.89.3 contains a patch.
Responsável
GitHub_M
Reservar
18/03/2026
Divulgação
24/03/2026
Inscrições
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidade | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 352592 | salvo-rs salvo form_data Negação de Serviço | 770 | Não definido | Correção oficial | CVE-2026-33241 |