CVE-2025-11230

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

This is a security vulnerability affecting Debian systems, requiring further analysis for specific details.(CVE-2025-11230)

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

This is a security vulnerability affecting Debian systems, requiring further analysis for specific details.(CVE-2025-11230)

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

This is a security vulnerability affecting Debian systems, requiring further analysis for specific details.(CVE-2025-11230)

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

This is a security vulnerability affecting Debian systems, requiring further analysis for specific details.(CVE-2025-11230)

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

This is a security vulnerability affecting Debian systems, requiring further analysis for specific details.(CVE-2025-11230)

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

• haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

• haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

• haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

• haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

• CVE-2025-11230: fix denial of service vulnerability in mjson library by optimizing exponent calculation to prevent CPU exhaustion from crafted JSON requests

• CVE-2025-11230: fix possible DoS in mjson library when parsing numbers

Haproxy has a critical, a major, few medium and few minor bugs fixed in the last upstream version 2.8.16 of branch 2.8.

Fixed critical bug list:

• mjson: fix possible DoS when parsing numbers

Fixed major bug list:

• listeners: transfer connection accounting when switching listeners

Fixed medium bugs list:

• check: Requeue healthchecks on I/O events to handle check timeout
• check: Set SOCKERR by default when a connection error is reported
• checks: fix ALPN inheritance from server
• dns: Reset reconnect tempo when connection is finally established
• fd: Use the provided tgid in fd_insert() to get tgroup_info
• h1: Allow reception if we have early data
• h1/h2/h3: reject forbidden chars in the Host header field
• h2/h3: reject some forbidden chars in :authority before reassembly
• hlua: Add function to change the body length of an HTTP Message
• hlua: Forbid any L6/L7 sample fetche functions from lua services
• hlua: Report to SC when data were consumed on a lua socket
• hlua: Report to SC when output data are blocked on a lua socket
• http-client: Ask for more room when request data cannot be xferred
• http-client: Don't wake http-client applet if nothing was xferred
• http-client: Drain the request if an early response is received
• http-client: Notify applet has more data to deliver until the EOM
• http-client: Properly inc input data when HTX blocks are xferred
• http-client: Test HTX_FL_EOM flag before commiting the HTX buffer
• httpclient: Throw an error if an lua httpclient instance is reused
• mux-h2: Properly handle connection error during preface sending
• server: Duplicate healthcheck's alpn inherited from default server
• ssl: ca-file directory mode must read every certificates of a file
• ssl/clienthello: ECDSA with ssl-max-ver TLSv1.2 and no ECDSA ciphers
• ssl: create the mux immediately on early data
• ssl: Fix 0rtt to the server
• ssl: fix build with AWS-LC
• threads: Disable the workaround to load libgcc_s on macOS

These are all security issues fixed in the haproxy-3.2.6+git0.81568b2d1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for haproxy fixes the following issues:

• CVE-2025-11230: issue in the mjson JSON decoder leads to excessive resource consumption when processing numbers with large exponents (bsc#1250983).

This update for haproxy fixes the following issues:

• CVE-2025-11230: Fixed issue in the mjson JSON decoder, that could have let to excessive resource consumption when processing numbers with large exponents (bsc#1250983).

This update for haproxy fixes the following issues:

• CVE-2025-11230: Fixed issue in the mjson JSON decoder, that could have let to excessive resource consumption when processing numbers with large exponents (bsc#1250983).

This update for haproxy fixes the following issues:

• CVE-2025-11230: Fixed mjson JSON decoder excessive resource consumption (bsc#1250983)

This update for haproxy fixes the following issues:

• CVE-2025-11230: Fixed mjson JSON decoder excessive resource consumption (bsc#1250983)

This update for haproxy fixes the following issues:

• CVE-2025-11230: issue in the mjson JSON decoder leads to excessive resource consumption when processing numbers with large exponents (bsc#1250983).

This update for haproxy fixes the following issues:

• CVE-2025-11230: issue in the mjson JSON decoder leads to excessive resource consumption when processing numbers with large exponents (bsc#1250983).

This update for haproxy fixes the following issues:

• CVE-2025-11230: issue in the mjson JSON decoder leads to excessive resource consumption when processing numbers with large exponents (bsc#1250983).

Oula Kivalo discovered that HAProxy incorrectly handled parsing certain json numbers. A remote attacker could possibly use this issue to cause HAProxy to crash, resulting in a denial of service.