CVE-2025-22242 CVE-2025-22242 salt advisory
An attacker can cause a denial of service in Salt Master by exploiting unsanitized input in the pub_ret method to read from blocking file nodes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-22242?
CVE-2025-22242 is a medium-severity denial of service vulnerability in VMware SALT, published on 13 Jun 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.
Weakness: CWE-400
Which versions are affected by CVE-2025-22242?
5 open source packages ship an affected version, including salt.
| Package | Affected | Fixed in |
|---|---|---|
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3007.0rc1 | 3007.4, 3006.12 |
salt PyPI | From 3007.0rc1 | 3007.4 |
salt PyPI | From 3007.0rc1 | 3007.4 |
How do I fix CVE-2025-22242?
Upgrade salt to a fixed version for your release line: 3006.12 or 3007.4.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-22242 being exploited?
There is no known exploitation of CVE-2025-22242 in the wild and no public exploit code.
Sources
Also known as GHSA-989c-m532-p2hv, PYSEC-2026-1896, UBUNTU-CVE-2025-22242.