IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.5High

CVE-2025-11230Denial of service vulnerability in HAProxy mjson library

HAProxy Technologies HAProxy Community Edition Published: (11 months ago)

Description

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

Weakness (CWE): CWE-407

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
haproxy aloha appliance 14.5.0 – < 14.5.33
haproxy haproxy 2.4.0 – < 2.4.30
HAProxy Technologies HAProxy Community Edition 2.4.0 – < 2.4.30, 2.6.0 – < 2.6.23, 2.8.0 – < 2.8.16, 3.0.0 – < 3.0.12, 3.1.0 – < 3.1.9, 3.2.0 – < 3.2.6
haproxy haproxy enterprise 2.4r1
haproxy kubernetes ingress controller < 1.9.14-ee7

References and patches

CPE matches (NVD) (60)
  • cpe:2.3:a:haproxy:aloha_appliance:*:*:*:*:*:*:*:* ≥ 14.5.0 < 14.5.33
  • cpe:2.3:a:haproxy:aloha_appliance:*:*:*:*:*:*:*:* ≥ 15.5.0 < 15.5.28
  • cpe:2.3:a:haproxy:aloha_appliance:*:*:*:*:*:*:*:* ≥ 16.5.0 < 16.5.19
  • cpe:2.3:a:haproxy:aloha_appliance:*:*:*:*:*:*:*:* ≥ 17.0.0 < 17.0.7
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 2.4.0 < 2.4.30
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 2.6.0 < 2.6.23
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 2.8.0 < 2.8.16
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.0.12
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 3.1.0 < 3.1.9
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 3.2.0 < 3.2.6
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-253.271:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-254.271:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-259.342:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-263.343:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-264.356:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-268.356:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-268.373:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-268.459:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-268.464:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-268.477:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-268.499:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-268.553:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-268.560:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-268.564:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-268.596:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-269.596:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-269.599:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-270.616:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-271.673:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-271.677:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-272.683:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-272.686:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-272.728:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-274.752:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-276.752:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-277.814:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-277.831:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-278.838:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-279.852:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-279.859:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-279.877:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-279.911:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-279.940:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-279.952:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-279.953:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-279.956:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-280.956:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-282.998:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-282.999:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-284.999:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-285.1010:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-286.1064:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-286.1068:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-286.1089:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-286.1094:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-288.1094:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-288.1158:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-288.1167:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-288.1189:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:2.4r1:1.0.0-289.1189:*:*:*:*:*:*

Recent CVEs in the same product — HAProxy

7.5High
CVE-2026-110353
HAProxy HAProxy; HAProxy HAProxy Enterprise Edition; HAProxy Kubernetes Ingress Controller; Haproxy Kubernetes Ingress Controller Enterprise

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handler…

7.5High
CVE-2026-110354
HAProxy HAProxy; HAProxy HAProxy Enterprise Edition; HAProxy Technologies HAProxy Kubernetes Ingress Controller; HAProxy Technologies Kubernetes Ingress Controller Enterprise

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeat…

7.5High
CVE-2026-90678
HAProxy HAProxy

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend …

3.7Low
CVE-2026-26080
HAProxy HAProxy

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

4.8Medium
CVE-2026-26081
HAProxy HAProxy

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.