Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce …

CVE-2026-33241 affects Salvo, a Rust web framework, in versions prior to 0.89.3. The vulnerability exists in the form data parsing implementations (form_data() method and Extractible macro) which do not enforce payload size limits before reading request bodies into memory. This lack of size validation allows attackers to send extremely large payloads causing Out-of-Memory (OOM) conditions. The vulnerability leads to service crashes and denial of service attacks. A patch is available in version 0.89.3 that addresses this memory exhaustion issue.