Salvo is a Rust-based web framework used to build web applications and services. Prior to version 0.89.3, Salvo's form data parsing implementations, specifically the `form_data()` method and the `Extractible` macro, do not impose any restrictions on the size of the payloads they process. When a client sends form data, these methods read the entire request body into memory without enforcing size limits or throttling. This lack of resource control can be exploited by an attacker who sends extremely large payloads, causing the server to allocate excessive memory. The uncontrolled memory allocation can lead to Out-of-Memory (OOM) conditions, resulting in application crashes and denial of service. The vulnerability is classified under CWE-770, which concerns allocation of resources without limits or throttling. The CVSS 4.0 base score of 8.7 reflects the vulnerability's high impact on availability, ease of exploitation (no authentication or user interaction required), and network attack vector. The patch in version 0.89.3 introduces payload size limits to prevent such resource exhaustion attacks. Although no exploits have been observed in the wild, the vulnerability poses a significant risk to any service using vulnerable Salvo versions, especially those exposed to untrusted networks.

The primary impact of this vulnerability is denial of service through resource exhaustion. Attackers can cause Salvo-based applications to crash by sending large form data payloads, leading to service unavailability. This can disrupt business operations, degrade user experience, and potentially cause cascading failures if the affected service is critical in a larger infrastructure. Since the vulnerability does not require authentication or user interaction, it can be exploited remotely by any attacker with network access to the vulnerable service. Organizations relying on Salvo for web services, APIs, or microservices are at risk of downtime and potential reputational damage. Additionally, repeated exploitation attempts could increase operational costs due to incident response and recovery efforts. Although confidentiality and integrity are not directly impacted, the availability impact alone is significant, especially for high-traffic or critical applications.

Organizations should immediately upgrade Salvo to version 0.89.3 or later, which includes the patch enforcing payload size limits during form data parsing. Until upgrading is possible, implement network-level protections such as rate limiting, request size restrictions, and Web Application Firewalls (WAFs) configured to block unusually large POST requests targeting form data endpoints. Monitoring application logs for abnormal request sizes and memory usage spikes can help detect exploitation attempts early. Developers should review their use of Salvo's form data parsing methods to ensure they do not bypass the patched mechanisms. Additionally, consider deploying application-level resource quotas and timeouts to limit the impact of resource exhaustion attacks. Regularly audit dependencies for updates and security patches to maintain a secure software supply chain.