{"id":"CVE-2025-11230","aliases":["ALSA-2025:21691","ALSA-2025:21693","AZL-70538","AZL-70583","BIT-haproxy-2025-11230","CLSA-2025-1764324159","CLSA-2025-1765545936","DEBIAN-CVE-2025-11230","DSA-6017-1","EUVD-2025-198149","GHSA-fc36-5gc3-jmhx","MGASA-2025-0242","OESA-2025-2418","OESA-2025-2419","OESA-2025-2420","OESA-2025-2421","OESA-2025-2422","RHSA-2025:21691","RHSA-2025:21692","RHSA-2025:21693","RHSA-2025:21694","RHSA-2025:22398","RHSA-2025:22399","RHSA-2025:22422","RHSA-2026:8729","RLSA-2025:21691","RLSA-2025:21693","SUSE-SU-2025:03587-1","SUSE-SU-2025:03589-1","SUSE-SU-2025:20872-1","SUSE-SU-2025:20900-1","SUSE-SU-2026:20092-1","SUSE-SU-2026:20094-1","SUSE-SU-2026:20109-1","UBUNTU-CVE-2025-11230","USN-7805-1","openSUSE-SU-2025:15599-1","openSUSE-SU-2026:20032-1"],"status":"published","title":"Denial of service vulnerability in HAProxy mjson library","description":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0074,"percentile":0.54861,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2025-10-02T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"haproxy","fixed_in":["3.0.5-4.el10_1.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"haproxy","fixed_in":["2.8.14-1.el9_7.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"haproxy","fixed_in":["2.4.24-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"haproxy","fixed_in":["2.9.11-4"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"haproxy","fixed_in":["2.4.30","2.6.23","2.8.16","3.0.12","3.1.9","3.2.6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"haproxy","fixed_in":["2.4.17-6.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"haproxy","fixed_in":["2.4.22-4.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"haproxy","fixed_in":["2.6.12-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["3.0.11-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["3.2.5-2"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"haproxy","fixed_in":["2.8.16-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"haproxy","fixed_in":["2.6.6-18.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"haproxy","fixed_in":["2.9.5-12.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"haproxy","fixed_in":["2.9.5-12.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"haproxy","fixed_in":["2.9.5-12.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"haproxy","fixed_in":["2.6.6-18.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"haproxy","fixed_in":["0:3.0.5-4.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"haproxy-debuginfo","fixed_in":["0:3.0.5-4.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"haproxy-debugsource","fixed_in":["0:3.0.5-4.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy","fixed_in":["0:3.0.5-4.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy-debuginfo","fixed_in":["0:3.0.5-4.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy-debugsource","fixed_in":["0:3.0.5-4.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy","fixed_in":["0:2.8.14-1.el9_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debuginfo","fixed_in":["0:2.8.14-1.el9_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debugsource","fixed_in":["0:2.8.14-1.el9_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy","fixed_in":["0:2.4.22-4.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy-debuginfo","fixed_in":["0:2.4.22-4.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy-debugsource","fixed_in":["0:2.4.22-4.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy","fixed_in":["0:2.4.17-6.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy-debuginfo","fixed_in":["0:2.4.17-6.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy-debugsource","fixed_in":["0:2.4.17-6.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"haproxy","fixed_in":["0:2.4.22-3.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"haproxy-debuginfo","fixed_in":["0:2.4.22-3.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"haproxy-debugsource","fixed_in":["0:2.4.22-3.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"haproxy","fixed_in":["0:2.4.7-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"haproxy-debuginfo","fixed_in":["0:2.4.7-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"haproxy-debugsource","fixed_in":["0:2.4.7-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"haproxy","fixed_in":["0:3.0.19-1.hum1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"haproxy","fixed_in":["0:3.0.5-4.el10_1.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"haproxy","fixed_in":["0:2.8.14-1.el9_7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"haproxy","fixed_in":["2.8.11+git0.01c1056a4-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"haproxy","fixed_in":["2.8.11+git0.01c1056a4-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"haproxy","fixed_in":["2.8.11+git0.01c1056a4-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"haproxy","fixed_in":["2.8.11+git0.01c1056a4-2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"haproxy","fixed_in":["2.8.11+git0.01c1056a4-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"haproxy","fixed_in":["3.2.0+git0.e134140d2-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"haproxy","fixed_in":["3.2.0+git0.e134140d2-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"haproxy","fixed_in":["3.2.0+git0.e134140d2-160000.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","fixed_in":["2.4.24-0ubuntu0.22.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"haproxy","fixed_in":["2.8.5-1ubuntu3.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"haproxy","fixed_in":["3.2.6+git0.81568b2d1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"haproxy","fixed_in":["3.2.0+git0.e134140d2-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-4.el10_1.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.14-1.el9_7.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.24-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.11-4"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"haproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.30"},{"introduced":"2.6.0"},{"fixed":"2.6.23"},{"introduced":"2.8.0"},{"fixed":"2.8.16"},{"introduced":"3.0.0"},{"fixed":"3.0.12"},{"introduced":"3.1.0"},{"fixed":"3.1.9"},{"introduced":"3.2.0"},{"fixed":"3.2.6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-6.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-4.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.12-1+deb12u3"}]}],"versions":["2.6.12-1","2.6.12-1+deb12u1","2.6.12-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-1+deb13u1"}]}],"versions":["3.0.11-1"]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-2"}]}],"versions":["3.0.11-1","3.1.0-1","3.1.0-2","3.1.1-1","3.1.2-1","3.1.3-1","3.1.5-1","3.1.6-1","3.1.7-1","3.2.0-1","3.2.1-1","3.2.3-1","3.2.3-2","3.2.4-1","3.2.5-1"]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.12-1+deb12u3"}]}],"versions":["2.6.12-1","2.6.12-1+deb12u1","2.6.12-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-1+deb13u1"}]}],"versions":["3.0.11-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.16-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-18.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-12.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-12.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-12.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-18.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-1.el9_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-1.el9_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-1.el9_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-4.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-4.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-4.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.7-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.7-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.7-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.19-1.hum1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_1.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-1.el9_7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0+git0.e134140d2-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0+git0.e134140d2-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0+git0.e134140d2-160000.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.24-0ubuntu0.22.04.3"}]}],"versions":["2.2.9-2ubuntu2","2.4.8-1","2.4.8-2ubuntu3","2.4.11-1ubuntu1","2.4.12-1ubuntu1","2.4.12-1ubuntu2","2.4.13-1ubuntu1","2.4.14-1ubuntu1","2.4.18-0ubuntu1","2.4.18-0ubuntu1.1","2.4.18-0ubuntu1.2","2.4.18-0ubuntu1.3","2.4.22-0ubuntu0.22.04.1","2.4.22-0ubuntu0.22.04.2","2.4.22-0ubuntu0.22.04.3","2.4.24-0ubuntu0.22.04.1","2.4.24-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-1ubuntu3.4"}]}],"versions":["2.6.15-1ubuntu2","2.8.5-1ubuntu1","2.8.5-1ubuntu2","2.8.5-1ubuntu3","2.8.5-1ubuntu3.1","2.8.5-1ubuntu3.2","2.8.5-1ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.24-0ubuntu0.22.04.3"}]}],"versions":["2.2.9-2ubuntu2","2.4.8-1","2.4.8-2ubuntu3","2.4.11-1ubuntu1","2.4.12-1ubuntu1","2.4.12-1ubuntu2","2.4.13-1ubuntu1","2.4.14-1ubuntu1","2.4.18-0ubuntu1","2.4.18-0ubuntu1.1","2.4.18-0ubuntu1.2","2.4.18-0ubuntu1.3","2.4.22-0ubuntu0.22.04.1","2.4.22-0ubuntu0.22.04.2","2.4.22-0ubuntu0.22.04.3","2.4.24-0ubuntu0.22.04.1","2.4.24-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-1ubuntu3.4"}]}],"versions":["2.6.15-1ubuntu2","2.8.5-1ubuntu1","2.8.5-1ubuntu2","2.8.5-1ubuntu3","2.8.5-1ubuntu3.1","2.8.5-1ubuntu3.2","2.8.5-1ubuntu3.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6+git0.81568b2d1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0+git0.e134140d2-160000.3.1"}]}]}],"products":[{"vendor":"haproxy","product":"aloha_appliance"},{"vendor":"haproxy","product":"haproxy"},{"vendor":"haproxy","product":"haproxy_enterprise"},{"vendor":"haproxy","product":"kubernetes_ingress_controller"},{"vendor":"haproxy technologies","product":"haproxy community edition"}],"references":[{"url":"https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability","tags":["Vendor Advisory","advisory","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11230","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fc36-5gc3-jmhx"},{"url":"https://access.redhat.com/errata/RHSA-2025:21691","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11230","tags":["report"]},{"url":"https://bugzilla.redhat.com/2413003","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-21691.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:21693","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-21693.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1764324159.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2025-1765545936.html","tags":["advisory"]},{"url":"https://git.haproxy.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11230.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-11230","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0242.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34673","tags":["report"]},{"url":"https://www.haproxy.org/download/2.8/src/CHANGELOG","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2418","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2419","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2420","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2421","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2422","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2413003","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21691.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11230","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2025:21692","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21692.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21693.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:21694","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21694.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22398","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22398.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22399","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22399.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22422","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22422.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8729","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8729.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:21691","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:21693","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503587-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250983","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11230","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503589-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520872-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520900-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620092-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620094-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620109-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-11230","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7805-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-11230","title":"Denial of service vulnerability in HAProxy mjson library","description":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.","status":"published","published":"2025-11-19T09:28:39.75Z","modified":"2025-11-19T17:09:15.642Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:32:50.872559Z"}],"euvd":[{"id":"EUVD-2025-198149","description":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.","status":"published","published":"2025-11-19T09:28:39Z","modified":"2025-11-19T17:09:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:15.429944Z"}],"ghsa":[{"id":"GHSA-fc36-5gc3-jmhx","title":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of...","description":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.","status":"published","published":"2025-11-19T12:30:20Z","modified":"2025-11-19T12:30:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:04:52.427555Z"}],"nvd":[{"id":"CVE-2025-11230","description":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.","status":"published","published":"2025-11-19T10:15:45.02Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:11:44.669367Z"}],"osv":[{"id":"CVE-2025-11230","title":"Denial of service vulnerability in HAProxy mjson library","description":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.","status":"published","published":"2025-11-19T09:28:39.75Z","modified":"2026-11-02T02:30:34.355801898Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"DEBIAN-CVE-2025-11230","description":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.","status":"published","published":"2025-11-19T10:15:45.02Z","modified":"2026-10-23T17:47:31.768481036Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"OESA-2025-2418","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nThis is a security vulnerability affecting Debian systems, requiring further analysis for specific details.(CVE-2025-11230)","status":"published","published":"2025-10-17T11:09:30Z","modified":"2026-08-18T01:19:13.789738955Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2419","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nThis is a security vulnerability affecting Debian systems, requiring further analysis for specific details.(CVE-2025-11230)","status":"published","published":"2025-10-17T11:09:30Z","modified":"2026-08-18T01:19:13.691180682Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2420","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nThis is a security vulnerability affecting Debian systems, requiring further analysis for specific details.(CVE-2025-11230)","status":"published","published":"2025-10-17T11:09:30Z","modified":"2026-08-18T01:19:13.685940181Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2421","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nThis is a security vulnerability affecting Debian systems, requiring further analysis for specific details.(CVE-2025-11230)","status":"published","published":"2025-10-17T11:09:30Z","modified":"2026-08-18T01:19:13.870802562Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2422","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nThis is a security vulnerability affecting Debian systems, requiring further analysis for specific details.(CVE-2025-11230)","status":"published","published":"2025-10-17T11:09:30Z","modified":"2026-08-18T01:19:13.89446915Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2025:21691","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2025-11-19T10:08:55Z","modified":"2026-10-02T10:05:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:21692","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2025-11-19T10:08:55Z","modified":"2026-10-02T10:05:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:21693","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2025-11-19T10:08:56Z","modified":"2026-10-02T10:05:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:21694","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2025-11-19T10:08:56Z","modified":"2026-10-02T10:05:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:22398","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2025-12-02T10:06:41Z","modified":"2026-10-02T10:05:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:22399","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2025-12-02T10:06:41Z","modified":"2026-10-02T10:05:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:22422","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2025-12-02T10:06:46Z","modified":"2026-10-02T10:05:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2026:8729","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:12:14Z","modified":"2026-10-01T10:21:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2025:21691","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-11-25T09:18:33.442635Z","modified":"2025-11-25T09:49:04.022105Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:21693","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-11-21T18:13:51.682496Z","modified":"2025-11-21T18:48:57.330574Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2025-11230","description":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.","status":"published","published":"2025-10-02T00:00:00Z","modified":"2026-02-04T02:15:58.768413Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ALSA-2025:21691","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.  \n\nSecurity Fix(es):  \n\n  * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-11-18T00:00:00Z","modified":"2026-10-29T11:58:17.146337Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:21693","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.  \n\nSecurity Fix(es):  \n\n  * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-11-18T00:00:00Z","modified":"2026-10-29T11:32:29.101684636Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-70538","title":"CVE-2025-11230 affecting package haproxy for versions less than 2.4.24-2","description":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.","status":"published","published":"2025-11-19T10:15:45Z","modified":"2026-04-21T04:36:25.41612Z","updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"AZL-70583","title":"CVE-2025-11230 affecting package haproxy for versions less than 2.9.11-4","description":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.","status":"published","published":"2025-11-19T10:15:45Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.144367Z"},{"id":"BIT-haproxy-2025-11230","title":"Denial of service vulnerability in HAProxy mjson library","description":"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.","status":"published","published":"2025-12-20T11:38:08.173Z","modified":"2026-09-08T08:47:51.984897156Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CLSA-2025-1764324159","title":"haproxy: Fix of CVE-2025-11230","description":"- CVE-2025-11230: fix denial of service vulnerability in mjson library by\n  optimizing exponent calculation to prevent CPU exhaustion from crafted\n  JSON requests","status":"published","published":"2025-11-28T10:02:43Z","modified":"2026-06-01T00:31:28.368511414Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2025-1765545936","title":"haproxy: Fix of CVE-2025-11230","description":"- CVE-2025-11230: fix possible DoS in mjson library when parsing numbers","status":"published","published":"2025-12-12T13:25:39Z","modified":"2026-06-01T00:32:36.976445246Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"DSA-6017-1","title":"haproxy - security update","status":"published","published":"2025-10-03T00:00:00Z","modified":"2025-10-03T13:17:20.594589Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0242","title":"Updated haproxy packages fix security vulnerability \u0026 bugs","description":"Haproxy has a critical, a major, few medium and few minor bugs fixed in the\nlast upstream version 2.8.16 of branch 2.8.\n\nFixed critical bug list:\n- mjson: fix possible DoS when parsing numbers\n\nFixed major bug list:\n- listeners: transfer connection accounting when switching listeners\n\nFixed medium bugs list:\n- check: Requeue healthchecks on I/O events to handle check timeout\n- check: Set SOCKERR by default when a connection error is reported\n- checks: fix ALPN inheritance from server\n- dns: Reset reconnect tempo when connection is finally established\n- fd: Use the provided tgid in fd_insert() to get tgroup_info\n- h1: Allow reception if we have early data\n- h1/h2/h3: reject forbidden chars in the Host header field\n- h2/h3: reject some forbidden chars in :authority before reassembly\n- hlua: Add function to change the body length of an HTTP Message\n- hlua: Forbid any L6/L7 sample fetche functions from lua services\n- hlua: Report to SC when data were consumed on a lua socket\n- hlua: Report to SC when output data are blocked on a lua socket\n- http-client: Ask for more room when request data cannot be xferred\n- http-client: Don't wake http-client applet if nothing was xferred\n- http-client: Drain the request if an early response is received\n- http-client: Notify applet has more data to deliver until the EOM\n- http-client: Properly inc input data when HTX blocks are xferred\n- http-client: Test HTX_FL_EOM flag before commiting the HTX buffer\n- httpclient: Throw an error if an lua httpclient instance is reused\n- mux-h2: Properly handle connection error during preface sending\n- server: Duplicate healthcheck's alpn inherited from default server\n- ssl: ca-file directory mode must read every certificates of a file\n- ssl/clienthello: ECDSA with ssl-max-ver TLSv1.2 and no ECDSA ciphers\n- ssl: create the mux immediately on early data\n- ssl: Fix 0rtt to the server\n- ssl: fix build with AWS-LC\n- threads: Disable the workaround to load libgcc_s on macOS\n","status":"published","published":"2025-10-22T20:07:31Z","modified":"2026-04-16T04:44:45.460823983Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15599-1","title":"haproxy-3.2.6+git0.81568b2d1-1.1 on GA media","description":"These are all security issues fixed in the haproxy-3.2.6+git0.81568b2d1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-04T00:00:00Z","modified":"2026-03-23T04:53:59.279388Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20032-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: issue in the mjson JSON decoder leads to excessive resource consumption when processing numbers with\n  large exponents (bsc#1250983).\n","status":"published","published":"2026-01-14T10:56:00Z","modified":"2026-03-23T04:54:41.915414Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:03587-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: Fixed issue in the mjson JSON decoder, that could have let to excessive\n  resource consumption when processing numbers with large exponents (bsc#1250983).\n","status":"published","published":"2025-10-13T07:03:55Z","modified":"2026-02-04T03:18:37.548028Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:03589-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: Fixed issue in the mjson JSON decoder, that could have let to excessive\n  resource consumption when processing numbers with large exponents (bsc#1250983).\n","status":"published","published":"2025-10-13T07:04:38Z","modified":"2026-02-04T04:01:07.637699Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20872-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: Fixed mjson JSON decoder excessive resource consumption (bsc#1250983)\n","status":"published","published":"2025-10-23T15:27:42Z","modified":"2026-03-23T04:51:03.414101Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20900-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: Fixed mjson JSON decoder excessive resource consumption (bsc#1250983)\n","status":"published","published":"2025-10-24T12:38:16Z","modified":"2026-03-23T04:51:05.11197Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2026:20092-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: issue in the mjson JSON decoder leads to excessive resource consumption when processing numbers with\n  large exponents (bsc#1250983).\n","status":"published","published":"2026-01-14T10:57:49Z","modified":"2026-03-23T04:52:34.713853Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20094-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: issue in the mjson JSON decoder leads to excessive resource consumption when processing numbers with\n  large exponents (bsc#1250983).\n","status":"published","published":"2026-01-14T10:55:40Z","modified":"2026-03-23T04:52:34.825075Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20109-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: issue in the mjson JSON decoder leads to excessive resource consumption when processing numbers with\n  large exponents (bsc#1250983).\n","status":"published","published":"2026-01-14T10:55:40Z","modified":"2026-03-23T04:52:35.727929Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"USN-7805-1","title":"haproxy vulnerability","description":"Oula Kivalo discovered that HAProxy incorrectly handled parsing certain\njson numbers. A remote attacker could possibly use this issue to cause\nHAProxy to crash, resulting in a denial of service.","status":"published","published":"2025-10-06T14:09:00Z","modified":"2026-02-10T04:50:11Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}