CVE-2026-33241: 
Rust vulnerability analysis and mitigation

CVE-2026-33241 is a Denial of Service vulnerability in the Salvo web framework (Rust) caused by unbounded memory allocation during form data parsing. Salvo's form_data() method and Extractible macro do not enforce payload size limits before reading request bodies into memory, allowing attackers to trigger Out-of-Memory (OOM) conditions. All versions of the salvo crate prior to 0.89.3 are affected. The vulnerability was published on March 18, 2026, and assigned a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (Github Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). Three distinct attack vectors exist within Salvo's form handling: (1) URL-encoded form data (application/x-www-form-urlencoded) where Request::form_data() calls BodyExt::collect(body), reading the entire body into memory without size validation; (2) multipart form data (multipart/form-data) with similar unbounded allocation during parsing; and (3) the #[derive(Extractible)] macro with #[salvo(extract(default_source(from = "body")))], which internally calls form_data() and propagates the vulnerability to all body-sourced extractors. Although Request::payload_with_max_size() exists in the framework, it is not automatically applied in the form parsing code path. No authentication is required, and the attack can be executed with minimal bandwidth by streaming a large body (Github Advisory, Salvo Security Advisory).

Successful exploitation causes complete service unavailability: a single crafted request can exhaust all available memory on the server, forcing the Salvo process to crash with an OOM error rather than returning an HTTP 413 response. In containerized environments, the OOM condition can trigger cascading failures affecting co-located services sharing the same memory pool. There is no confidentiality or integrity impact; the vulnerability is purely an availability risk (Github Advisory).

A proof-of-concept (PoC) with concrete reproduction steps is publicly available in the GitHub Security Advisory, demonstrating the crash by running the framework's own readme example with a memory-constrained Docker container and sending an oversized form payload. No authentication or special privileges are required, and traditional rate limiting is ineffective against a single large request. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.016% (0.034% per GitHub Advisory), indicating a low current probability of exploitation (Salvo Security Advisory).

1. Reconnaissance: Identify internet-facing services built with the Salvo Rust web framework (versions < 0.89.3) that expose endpoints accepting application/x-www-form-urlencoded or multipart/form-data content types, or that use the #[derive(Extractible)] macro with body sources.
2. Identify target endpoint: Locate any public form submission endpoint (e.g., user registration, profile update, file upload, or any handler using req.form_data().await).
3. Craft oversized payload: Prepare an extremely large HTTP request body — either URL-encoded key-value pairs or a multipart body — designed to consume all available server memory when read into a buffer.
4. Send the malicious request: Transmit the crafted request to the target endpoint, streaming the large body. The server's FormData::read() implementation will call BodyExt::collect(body) without any size check, allocating memory unboundedly.
5. Trigger OOM crash: The server process exhausts available memory and is terminated by the OS OOM killer, causing a service outage. In containerized deployments, this may also affect neighboring containers (Salvo Security Advisory).

• Network: Unusually large HTTP POST requests (potentially gigabytes) with Content-Type: application/x-www-form-urlencoded or Content-Type: multipart/form-data headers targeting form-handling endpoints; requests with abnormally high Content-Length values.
• Logs: Salvo application logs showing abrupt process termination without a graceful shutdown message; absence of HTTP 413 responses where oversized payloads were sent; OS-level OOM killer log entries (e.g., Linux dmesg showing Out of memory: Kill process <pid> (salvo_app)).
• Process/System: Sudden spike in memory consumption by the Salvo server process immediately preceding a crash; container restart events in orchestration platforms (e.g., Kubernetes pod OOMKilled status) (Salvo Security Advisory).

Upgrade the salvo crate to version 0.89.3 or later, which is the official patched release (Salvo Release v0.89.3). As an interim workaround, enforce request body size limits at the reverse proxy or load balancer layer (e.g., Nginx client_max_body_size, AWS ALB request size limits) to reject oversized payloads before they reach the application. Additionally, monitor server memory usage and configure alerts for abnormal consumption patterns to detect exploitation attempts early (Github Advisory).

The vulnerability was reported by security researcher yshing and published by Salvo maintainer chrislearn on March 18, 2026. The advisory was noted in automated CVE tracking feeds and vulnerability databases shortly after disclosure, with no significant broader media coverage or notable researcher commentary beyond the official advisory (Salvo Security Advisory).