CVE-2025-11230
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Nov 19, 2025
CISA due date
—
The record
Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | haproxy | 0 | 3.0.5-4.el10_1.1 |
| AlmaLinux:9 | haproxy | 0 | 2.8.14-1.el9_7.1 |
| Bitnami | haproxy | 2.4.0 | 2.4.30 |
| Chainguard | haproxy-2.4 | 0 | 2.4.30-r0 |
| Chainguard | haproxy-2.4-doc | 0 | 2.4.30-r0 |
| Chainguard | haproxy-2.4-iamguarded-compat | 0 | 2.4.30-r0 |
| Chainguard | haproxy-2.4-nocaps | 0 | 2.4.30-r0 |
| Chainguard | haproxy-2.4-oci-entrypoint | 0 | 2.4.30-r0 |
| Chainguard | haproxy-2.6 | 0 | 2.6.23-r0 |
| Chainguard | haproxy-2.6-doc | 0 | 2.6.23-r0 |
| Chainguard | haproxy-2.6-iamguarded-compat | 0 | 2.6.23-r0 |
| Chainguard | haproxy-2.6-nocaps | 0 | 2.6.23-r0 |
| Chainguard | haproxy-2.6-oci-entrypoint | 0 | 2.6.23-r0 |
| Chainguard | haproxy-2.8 | 0 | 2.8.18-r0 |
| Chainguard | haproxy-2.8-doc | 0 | 2.8.18-r0 |
| Chainguard | haproxy-2.8-iamguarded-compat | 0 | 2.8.18-r0 |
| Chainguard | haproxy-2.8-nocaps | 0 | 2.8.18-r0 |
| Chainguard | haproxy-2.8-oci-entrypoint | 0 | 2.8.18-r0 |
| Mageia:9 | haproxy | 0 | 2.8.16-1.mga9 |
| SUSE:Linux Enterprise High Availability Extension 15 SP4 | haproxy | 0 | 2.4.22+git0.f8e3218e2-150400.3.25.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP5 | haproxy | 0 | 2.4.22+git0.f8e3218e2-150400.3.25.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | haproxy | 0 | 2.8.11+git0.01c1056a4-150600.3.9.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP7 | haproxy | 0 | 2.8.11+git0.01c1056a4-150600.3.9.1 |
| SUSE:Linux Enterprise Micro 5.3 | haproxy | 0 | 2.4.22+git0.f8e3218e2-150400.3.25.1 |
| SUSE:Linux Enterprise Micro 5.4 | haproxy | 0 | 2.4.22+git0.f8e3218e2-150400.3.25.1 |
| SUSE:Linux Enterprise Micro 5.5 | haproxy | 0 | 2.4.22+git0.f8e3218e2-150400.3.25.1 |
| openSUSE:Leap 15.6 | haproxy | 0 | 2.8.11+git0.01c1056a4-150600.3.9.1 |
| openSUSE:Leap 16.0 | haproxy | 0 | 3.2.0+git0.e134140d2-160000.3.1 |
| openSUSE:Tumbleweed | haproxy | 0 | 3.2.6+git0.81568b2d1-1.1 |
Related vulnerabilities
- CVE-2023-0836 An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3… Also affects haproxy
- CVE-2023-0056 An uncontrolled resource consumption vulnerability was discovered in HAProxy which could… Also affects haproxy
- CVE-2024-53008 Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue… Also affects haproxy
- CVE-2024-49214 QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows… Also affects haproxy
- CVE-2024-45506 HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a… Also affects haproxy
- CVE-2026-26081 HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the… Also affects haproxy
- CVE-2026-26080 HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash… Also affects haproxy
- CVE-2026-33555 An issue was discovered in HAProxy before 3.3.6. Also affects haproxy