p PatchFirst

CVE-2025-11230

CVE-2025-11230 · Denial of service vulnerability in HAProxy mjson library

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

CVSS 7.5 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • haproxy community edition

    Versions
    • ≥ 2.4.0, < 2.4.30: Affected (semver)
    • ≥ 2.6.0, < 2.6.23: Affected (semver)
    • ≥ 2.8.0, < 2.8.16: Affected (semver)
    • ≥ 3.0.0, < 3.0.12: Affected (semver)
    • ≥ 3.1.0, < 3.1.9: Affected (semver)
    • ≥ 3.2.0, < 3.2.6: Affected (semver)

    Update to 2.4.30; Update to 2.6.23; Update to 2.8.16; Update to 3.0.12; Update to 3.1.9; Update to 3.2.6

  • haproxy Debian:12

    Versions
    • 2.6.12-1
    • 2.6.12-1+deb12u1
    • 2.6.12-1+deb12u2
    Affected ranges
    • ECOSYSTEM: < 2.6.12-1+deb12u3

    Update to 2.6.12-1+deb12u3

  • haproxy Debian:13

    Versions
    • 3.0.11-1
    Affected ranges
    • ECOSYSTEM: < 3.0.11-1+deb13u1

    Update to 3.0.11-1+deb13u1

  • haproxy Debian:14

    Versions
    • 3.0.11-1
    • 3.1.0-1
    • 3.1.0-2
    • 3.1.1-1
    • 3.1.2-1
    • 3.1.3-1
    • 3.1.5-1
    • 3.1.6-1
    • 3.1.7-1
    • 3.2.0-1
    • 3.2.1-1
    • 3.2.3-1
    • 3.2.3-2
    • 3.2.4-1
    • 3.2.5-1
    Affected ranges
    • ECOSYSTEM: < 3.2.5-2

    Update to 3.2.5-2

  • haproxy Ubuntu:22.04:LTS

    Versions
    • 2.2.9-2ubuntu2
    • 2.4.8-1
    • 2.4.8-2ubuntu3
    • 2.4.11-1ubuntu1
    • 2.4.12-1ubuntu1
    • 2.4.12-1ubuntu2
    • 2.4.13-1ubuntu1
    • 2.4.14-1ubuntu1
    • 2.4.18-0ubuntu1
    • 2.4.18-0ubuntu1.1
    • 2.4.18-0ubuntu1.2
    • 2.4.18-0ubuntu1.3
    • 2.4.22-0ubuntu0.22.04.1
    • 2.4.22-0ubuntu0.22.04.2
    • 2.4.22-0ubuntu0.22.04.3
    • 2.4.24-0ubuntu0.22.04.1
    • 2.4.24-0ubuntu0.22.04.2
    Affected ranges
    • ECOSYSTEM: < 2.4.24-0ubuntu0.22.04.3

    Update to 2.4.24-0ubuntu0.22.04.3

  • haproxy Ubuntu:24.04:LTS

    Versions
    • 2.6.15-1ubuntu2
    • 2.8.5-1ubuntu1
    • 2.8.5-1ubuntu2
    • 2.8.5-1ubuntu3
    • 2.8.5-1ubuntu3.1
    • 2.8.5-1ubuntu3.2
    • 2.8.5-1ubuntu3.3
    Affected ranges
    • ECOSYSTEM: < 2.8.5-1ubuntu3.4

    Update to 2.8.5-1ubuntu3.4

Original sources

Check your server →