Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service. Version 0.89.3 contains a patch.

Affected: crates.io: salvo

## Summary Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service.

## Details ### Vulnerability Description Three attack vectors exist in Salvo's form handling:

1. **URL-encoded form data** (`application/x-www-form-urlencoded`) - `Request::form_data()` calls `BodyExt::collect(body)` which reads the entire body into memory without size checking - Affects handlers using `req.form_data().await` directly

2. **Multipart form data** (`multipart/form-data`) - Similar unbounded memory allocation during parsing - Affects handlers processing multipart uploads

3. **Extractible macro** - `#[derive(Extractible)]` with `#[salvo(extract(default_source(from = "body")))]` internally calls `form_data()` - Vulnerabilities propagate to all extractors using body sources

### Root Cause The `FormData::read()` implementation prioritizes convenience over safety by reading entire request bodies before validation. Even when `Request::payload_with_max_size()` is available, it's not automatically applied in the form parsing path.

### PoC 1. run `Extract data from request` example in readme.md in docker file with limited memory say 100mb. 2. Send `application/x-www-form-urlencoded` OR `multipart/form-data` payload to the endp…