Skip to content
Fencer Vulns
high 7.5

CVE-2025-11230 json

Denial of service vulnerability in HAProxy mjson library

published 2025-11-19 11 mo ago modified 2026-10-18 21 d ago also BIT-haproxy-2025-11230 , EUVD-2025-198149

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

Patch / fix

  • bitnami haproxy 2.4.30, 2.6.23, 2.8.16, 3.0.12, 3.1.9, 3.2.6
  • HAProxy Technologies HAProxy Community Edition 2.4.30, 2.6.23, 2.8.16, 3.0.12, 3.1.9, 3.2.6
  • haproxy Debian 12 2.6.12-1+deb12u3
  • haproxy Debian 13 3.0.11-1+deb13u1
  • haproxy Debian 14 3.2.5-2

debian advisories DEBIAN-CVE-2025-11230

  • haproxy Ubuntu 22.04 LTS 2.4.24-0ubuntu0.22.04.3
  • haproxy Ubuntu 24.04 LTS 2.8.5-1ubuntu3.4

ubuntu advisories UBUNTU-CVE-2025-11230

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • haproxy hummingbird 1 3.0.19-1.hum1
  • haproxy RHEL 9 2.8.14-1.el9_7.1
  • haproxy RHEL 10.1 3.0.5-4.el10_1.1
  • haproxy RHEL 9.0 E4S 2.4.7-2.el9_0.3
  • haproxy RHEL 9.2 E4S 2.4.17-6.el9_2.3
  • haproxy RHEL 9.4 EUS 2.4.22-3.el9_4.1
  • haproxy RHEL 9.6 EUS 2.4.22-4.el9_6.1
  • haproxy enterprise linux eus 10.0 3.0.5-4.el10_0.1

red hat advisories RHSA-2026:8729RHSA-2025:22422RHSA-2025:22398RHSA-2025:22399RHSA-2025:21693RHSA-2025:21694

  • haproxy SLE High Availability Extension 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.2.0+git0.e134140d2-160000.3.1
  • haproxy Linux Micro 6.1 2.8.11+git0.01c1056a4-slfo.1.1_2.1
  • haproxy Linux Micro 6.0 2.8.11+git0.01c1056a4-2.1
  • haproxy SLE Micro 5.5, SLE Micro 5.4, SLE Micro 5.3 +2 more 2.4.22+git0.f8e3218e2-150400.3.25.1
  • haproxy SLE High Availability Extension 15 SP7, SLE High Availability Extension 15 SP6, openSUSE Leap 15.6 2.8.11+git0.01c1056a4-150600.3.9.1

suse advisories SUSE-SU-2026:20092-1SUSE-SU-2026:20094-1SUSE-SU-2026:20109-1SUSE-SU-2025:20900-1SUSE-SU-2025:20872-1SUSE-SU-2025:03589-1

  • haproxy openSUSE Leap 16.0 3.2.0+git0.e134140d2-160000.3.1
  • haproxy openSUSE Tumbleweed 3.2.6+git0.81568b2d1-1.1

opensuse advisories openSUSE-SU-2026:20032-1openSUSE-SU-2025:15599-1

  • haproxy AlmaLinux 10 3.0.5-4.el10_1.1
  • haproxy AlmaLinux 9 2.8.14-1.el9_7.1

almalinux advisories ALSA-2025:21691ALSA-2025:21693

  • haproxy Rocky Linux 10 3.0.5-4.el10_1.1
  • haproxy Rocky Linux 9 2.8.14-1.el9_7.1

rocky linux advisories RLSA-2025:21691RLSA-2025:21693

  • haproxy CBL-Mariner 2.0 2.4.24-2
  • haproxy Azure Linux 3.0 2.9.11-4

azure linux advisories AZL-70538AZL-70583

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-11230 updated cvss 7.5

haproxy: denial of service vulnerability in HAProxy mjson library

  • Red Hat Ceph Storage 5 haproxy, haproxy22 Red Hat OpenShift Container Platform 4 openshift4/ose-tests, openshift4/ose-tests-rhel9, openshift4/ose-haproxy-router, openshift4/ose-hypershift-rhel8, openshift4/ose-hypershift-rhel9
    affected: workaround, no fix available
  • Red Hat Ceph Storage 8 rhceph
    fixed: vendor fix RHSA-2025:22548
  • Red Hat Enterprise Linux AppStream (v. 9) haproxy 2.8.14-1.el9_7.1
    fixed: vendor fix RHSA-2025:21693
  • Red Hat Enterprise Linux AppStream (v. 10) haproxy 3.0.5-4.el10_1.1
    fixed: vendor fix RHSA-2025:21691
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) haproxy 2.4.7-2.el9_0.3
    fixed: vendor fix RHSA-2025:22422
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) haproxy 2.4.17-6.el9_2.3
    fixed: vendor fix RHSA-2025:22398
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) haproxy 3.0.5-4.el10_0.1
    fixed: vendor fix RHSA-2025:21692
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) haproxy 2.4.22-3.el9_4.1
    fixed: vendor fix RHSA-2025:22399
show 4 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) haproxy 2.4.22-4.el9_6.1
    fixed: vendor fix RHSA-2025:21694
  • Red Hat Hardened Images haproxy 3.0.19-1.hum1
    fixed: vendor fix RHSA-2026:8729
  • Red Hat Ceph Storage 8 rhceph Red Hat Enterprise Linux 7 haproxy
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 haproxy Red Hat OpenShift Container Platform 4 haproxy, haproxy18, haproxy20, haproxy22, haproxy26, haproxy28, +1 more
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
11 mo ago

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami haproxy
>=2.4.0, <2.4.30
>=2.6.0, <2.6.23
>=2.8.0, <2.8.16
>=3.0.0, <3.0.12
>=3.1.0, <3.1.9
>=3.2.0, <3.2.6
2.4.30
2.6.23
2.8.16
3.0.12
3.1.9
3.2.6

Affected products

  • HAProxy Technologies HAProxy Community Edition

Classification

Weakness
  • CWE-407 Inefficient Algorithmic Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.