java-topology/whitepaper/outreach/salt.md

Salt — CWE-407 / CWE-1333 Disclosure Brief

2026-04-13 · Patches available — awaiting upstream merge

Finding

Three CWE-407 algorithmic complexity defects and one CWE-1333 ReDoS vulnerability across Salt's cloud provisioning, thin packaging, saltclass, and PCRE matching subsystems.

The Defects

salt-0001 (PATCHED — MEDIUM): salt/cloud/__init__.py:1830 — Cycle detection in _has_loop()

# seen is a list; "val in seen" is O(N) per recursion step.
# list(seen) copies the entire list at every recursive call.
seen = []
# ...
seen.append(val)
if self._has_loop(dmap, seen=list(seen), val=machine):

O(N²) where N = number of machines in the cloud map dependency chain. Uses list for membership test and copies the entire list at each recursion level.

salt-0002 (PATCHED — LOW): salt/utils/thin.py:840 — Module dedup in gen_thin()

tops.extend(mod for mod in mods if mod not in tops)  # O(N) per mod

O(M×T) where M = saltext modules, T = existing tops list size.

salt-0003 (PATCHED — MEDIUM): salt/utils/saltclass.py:282 — Class expansion dedup

# seen_classes is a list; "klass not in seen_classes" is O(S).
if klass not in seen_classes:
    seen_classes.append(klass)

O(C×S) where C = classes to expand, S = seen classes count.

salt-0004 (PATCHED — HIGH): salt/matchers/pcre_match.py — ReDoS via user-controlled PCRE

# tgt comes from authenticated Salt API caller with tgt_type=pcre.
# A crafted pattern like ^(a+)+$ causes exponential backtracking.
return bool(re.match(tgt, minion_id))

CWE-1333: an authenticated Salt API caller can POST a crafted regex via tgt_type=pcre or tgt_type=grain_pcre that stalls the Salt master process indefinitely via exponential PCRE backtracking.

Complexity Proof

salt-0001: At N=50 machines in dependency chain: 50 × 50/2 = 1,250 → 50 with set salt-0003: At C=200 classes, S=200: 200 × 200/2 = 20,000 → 200 with set salt-0004: Pattern ^(a+)+$ against 'a'*25+'b' hangs indefinitely without timeout

Impact

Salt manages infrastructure at scale for thousands of organizations. salt-0004 poses the highest risk: an authenticated API user can denial-of-service the Salt master by submitting a crafted PCRE target expression. salt-0001 and salt-0003 affect cloud provisioning and class expansion performance at scale.

The Fix

salt-0001: Replace list with set for the seen parameter. salt-0002: Build a set(tops) for O(1) membership checks. salt-0003: Change seen_classes from list to set. salt-0004: Route re.match/re.compile through a ThreadPoolExecutor worker with 1-second timeout. Fail-closed: timeout or re.error returns False.

Patches

• defects/salt/patch/salt-0001-cloud-cycle-detection-set.patch
• defects/salt/patch/salt-0002-thin-tops-set-dedup.patch
• defects/salt/patch/salt-0003-saltclass-seen-set.patch
• defects/salt/patch/salt-0004-pcre-redos-safe-wrapper.patch

What We Ask

1. Confirm receipt and assign GitHub issue references (saltstack/salt).
2. Assess severity — salt-0004 enables authenticated DoS against the master.
3. Coordinate a disclosure date — targeting 90 days from first contact.
4. We will credit the Salt team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.