The vulnerability originates in Salvo's form data parsing logic, where the size of incoming payloads is not limited before the entire body is read into memory. This omission allows an adversary to send a deliberately massive form payload so that the process exhausts available memory, resulting in a crash or forced restart of the application server. The weakness is a classic unbounded allocation flaw (CWE‑770). Because the failure manifests as service unavailability rather than leakage or control compromise, the primary impact is denial of service.

Salvo framework from the Rust ecosystem, specifically versions earlier than 0.89.3. The affected component is the form_data() method and Extractible macro used by developers to parse multipart or URL‑encoded form bodies. Updating to Salvo 0.89.3 or newer removes the check and prevents the over‑allocation.

The severity score of 8.7 (CVSS v3.1) indicates a high risk. The EPSS probability is below 1 %, meaning exploitation is unlikely in the wild, but the omission can be leveraged by an attacker with network access to the web service, simply by crafting a very large HTTP request. Since the vulnerability is not listed in CISA’s KEV catalogue, there is no evidence of active exploitation. The entry point is a publicly exposed HTTP endpoint that accepts form data, so the attack vector is network‑based. Proper mitigation is by installing the patched version.