CVE-2026-33241 Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing
Attackers can crash Salvo web applications by sending large form data payloads, causing out-of-memory conditions and service unavailability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33241?
CVE-2026-33241 is a high-severity denial of service vulnerability in salvo-rs salvo, published on 23 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service. Version 0.89.3 contains a patch.
Weakness: CWE-770
Which versions are affected by CVE-2026-33241?
2 open source packages ship an affected version, including salvo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
salvo crates.io | All versions | 0.89.3 |
salvo crates.io | All versions | 0.89.3 |
Products include Salvo Salvo.
How do I fix CVE-2026-33241?
Upgrade salvo to 0.89.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33241 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33241 exists.
Other vulnerabilities in salvo-rs salvo
Sources
Also known as GHSA-pp9r-xg4c-8j4x.