CVE-2026-33241 in salvo-rs salvo

摘要 (英语)

Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service. Version 0.89.3 contains a patch.

负责

GitHub_M

预定

2026-03-18

披露

2026-03-24

条目

VulDB provides additional information and datapoints for this CVE:

标识符	漏洞	CWE	可利用	对策	CVE
352592	salvo-rs salvo form_data 拒绝服务	770	未定义	官方修复	CVE-2026-33241