8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33241

CVE-2026-33241: Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing

Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (form_data() method and Extractible macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service. Version 0.89.3 contains a patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33241

CVE-2026-33241:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
salvo	rust	< 0.89.3	0.89.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Salvo's handling of application/x-www-form-urlencoded and multipart/form-data request bodies. The core issue was that the function salvo::http::form::FormData::read would read the entire request body into memory before parsing, without enforcing any size limits. This was exposed to developers through several high-level API functions, most notably salvo::http::request::Request::form_data and salvo::http::request::Request::parse_body_with_max_size. An attacker could exploit this by sending a request with an extremely large body, causing the server to allocate an unbounded amount of memory, which would lead to an Out-of-Memory (OOM) crash and a Denial of Service. The vulnerability also affected any data structures using the Extractible derive macro to parse from the request body, as this macro's generated code would call these vulnerable functions.

The patch addresses this by introducing a size limit to the body parsing process. A new function, Request::form_data_max_size, was introduced, which wraps the request body in a Limited stream from the http_body_util crate. This ensures that reading from the body stops once the specified size limit is reached, preventing unbounded memory allocation. The existing Request::form_data function was updated to use this new size-limited function by default, effectively patching the primary attack vector.

Vulnerable functions

salvo::http::request::Request::form_data

crates/core/src/http/request.rs

This is the primary public API for parsing form data. The vulnerable version of this function passed the request body to the internal `FormData::read` function without any size limitations. This allowed an attacker to send an arbitrarily large request body, causing it to be read entirely into memory, leading to a denial-of-service. The patch refactors this function to call a new `form_data_max_size` function, which enforces a size limit by default.

salvo::http::form::FormData::read

crates/core/src/http/form.rs

This internal function is the root cause of the vulnerability. It was responsible for reading the request body and parsing it as form data. The vulnerable implementation, particularly for `application/x-www-form-urlencoded` content, used `BodyExt::collect(body)` which reads the entire body into memory before proceeding. This lack of a size check allowed for unbounded memory allocation. The patch changes this to consume a stream of bytes, which is now size-limited by the calling function.

salvo::http::request::Request::parse_body_with_max_size

crates/core/src/http/request.rs

This function, used to deserialize a request body into a struct, was also a vector for the vulnerability. When handling form data, it previously called the vulnerable `Request::form_data()` function without enforcing the `max_size` limit it was given. The patch corrects this by making it call the new `Request::form_data_max_size(max_size)` function, ensuring the size limit is respected for form data content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.