What’s Vulnerable › Vulnerabilities
CVE-2025-11230: Denial of service vulnerability in HAProxy mjson library
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-19 · updated 2026-10-18
- Weakness: CWE-407
Description
Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.
Affected products
- HAProxy Aloha Appliance: from 14.5.0 before 14.5.33; from 15.5.0 before 15.5.28; from 16.5.0 before 16.5.19; from 17.0.0 before 17.0.7 — fixed in 14.5.33, 15.5.28, 16.5.19, 17.0.7
- HAProxy: from 2.4.0 before 2.4.30; from 2.6.0 before 2.6.23; from 2.8.0 before 2.8.16; from 3.0.0 before 3.0.12; from 3.1.0 before 3.1.9; from 3.2.0 before 3.2.6 — fixed in 2.4.30, 2.6.23, 2.8.16, 3.0.12, 3.1.9, 3.2.6
- Haproxy Enterprise: 2.4r1-1.0.0-253.271, 2.4r1-1.0.0-254.271, 2.4r1-1.0.0-259.342, 2.4r1-1.0.0-263.343, 2.4r1-1.0.0-264.356, 2.4r1-1.0.0-268.356 (+180)
- HAProxy Kubernetes Ingress Controller: before 1.9.14-ee7; before 3.1.12; from 1.10.10-ee1 before 1.11.12-ee10; from 3.0.0-ee1 before 3.0.15-ee4 — fixed in 1.11.12-ee10, 1.9.14-ee7, 3.0.15-ee4, 3.1.12
How to fix
Upgrade to a fixed version: HAProxy Aloha Appliance 14.5.33, 15.5.28, 16.5.19, 17.0.7; HAProxy 2.4.30, 2.6.23, 2.8.16, 3.0.12; HAProxy Kubernetes Ingress Controller 1.11.12-ee10, 1.9.14-ee7, 3.0.15-ee4, 3.1.12. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-11230 or the next vulnerability affects your stack