CVE-2026-33241: Salvo Web Framework DoS Vulnerability

CVE-2026-33241 Overview

CVE-2026-33241 is a Denial of Service (DoS) vulnerability affecting Salvo, a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations—specifically the form_data() method and Extractible macro—do not enforce payload size limits before reading request bodies into memory. This design flaw allows attackers to trigger Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service.

Critical Impact

Attackers can remotely crash Salvo-based web applications by sending oversized payloads, causing memory exhaustion and service unavailability without requiring authentication.

Affected Products

• Salvo versions prior to 0.89.3
• Applications using the form_data() method for form parsing
• Applications utilizing the Extractible macro for request body extraction

Discovery Timeline

• March 24, 2026 - CVE-2026-33241 published to NVD
• March 24, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33241

Vulnerability Analysis

This vulnerability stems from improper resource allocation controls in Salvo's request handling mechanisms. The framework's form data parsing functionality lacks enforcement of payload size limits when processing incoming HTTP requests. When a request containing form data is received, the form_data() method and Extractible macro read the entire request body into memory without validating the content length against a configurable maximum threshold.

The absence of such bounds checking creates a resource exhaustion condition (CWE-770: Allocation of Resources Without Limits or Throttling). An attacker can exploit this by sending HTTP requests with arbitrarily large payloads, which the server will attempt to load entirely into memory. This can rapidly consume available RAM, triggering OOM killer behavior on Linux systems or causing the application process to crash.

Root Cause

The root cause is the lack of size validation in the form data parsing pipeline. The form_data() method reads request bodies directly into memory buffers without checking the Content-Length header against a maximum allowed size or implementing streaming limits. Similarly, the Extractible macro, which provides convenient request body extraction, inherits this behavior. This oversight means even a single malicious request with a multi-gigabyte payload can exhaust server memory resources.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker can craft HTTP POST requests targeting endpoints that process form data, including multipart form submissions. By setting a large Content-Length header and streaming arbitrary data, the attacker forces the vulnerable Salvo application to allocate memory proportional to the payload size.

The attack is straightforward to execute:

1. Identify a Salvo-based application endpoint that accepts form data
2. Send an HTTP POST request with a large Content-Length value (e.g., several gigabytes)
3. Stream data to the endpoint until the server exhausts available memory
4. The application crashes due to OOM, causing service disruption

The vulnerability is particularly dangerous in shared hosting environments or containerized deployments where memory limits may trigger cascading failures across services.

Detection Methods for CVE-2026-33241

Indicators of Compromise

• Unusually large HTTP POST requests targeting form submission endpoints
• Sudden memory spikes in Salvo application processes
• OOM killer events in system logs correlating with web server activity
• Service crashes or restarts without apparent cause during periods of low legitimate traffic

Detection Strategies

• Monitor HTTP request sizes at the reverse proxy or load balancer level to detect abnormally large payloads
• Implement application performance monitoring (APM) to track memory consumption patterns in Salvo applications
• Review web server access logs for POST requests with excessive Content-Length headers
• Configure alerting for OOM events and unexpected process terminations

Monitoring Recommendations

• Deploy memory usage monitoring with thresholds that trigger alerts before OOM conditions
• Implement request rate limiting and payload size enforcement at the network perimeter
• Use web application firewalls (WAF) configured to reject requests exceeding reasonable size limits
• Enable verbose logging for form data parsing operations to identify attack attempts

How to Mitigate CVE-2026-33241

Immediate Actions Required

• Upgrade Salvo to version 0.89.3 or later immediately
• Implement request size limits at the reverse proxy level (nginx, Apache, or cloud load balancer) as a defense-in-depth measure
• Review application endpoints that accept form data and ensure they are protected
• Consider implementing memory limits on application containers to prevent host-level impact

Patch Information

The Salvo development team has released version 0.89.3 which addresses this vulnerability by implementing proper payload size limits in the form data parsing functionality. Users should upgrade to this version or later to receive the fix.

For detailed patch information, refer to the GitHub Release v0.89.3 and the GitHub Security Advisory GHSA-pp9r-xg4c-8j4x.

Workarounds

• Configure reverse proxy or load balancer to enforce maximum request body size limits before requests reach the Salvo application
• Implement middleware-level size validation if upgrading is not immediately possible
• Deploy rate limiting to reduce the impact of sustained attack attempts
• Use container memory limits and health checks to enable automatic recovery from OOM conditions

# Example nginx configuration to limit request body size
# Add to server or location block
client_max_body_size 10M;
client_body_buffer_size 128k;