Skip to content
OpenAdvisories
High · 7.5 CVE-2025-11230 EUVD-2025-198149GHSA-fc36-5gc3-jmhx

Denial of service vulnerability in HAProxy mjson library

Published Nov 19, 2025 · Updated Nov 19, 2025 · Assigned by canonical

Vendor: HAProxy Product: HAProxy Community Edition Package: haproxy Package: haproxy Package: haproxy Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

Affected products

VendorProductAffectedFixed
HAProxy Technologies HAProxy Community Edition 2.4.0 – < 2.4.30, 2.6.0 – < 2.6.23, 2.8.0 – < 2.8.16, 3.0.0 – < 3.0.12, 3.1.0 – < 3.1.9, 3.2.0 – < 3.2.6 2.4.30

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 haproxy 3.2.5-2 —
Debian 13 haproxy 3.0.11-1+deb13u1 DSA-6017-1
Debian 12 haproxy 2.6.12-1+deb12u3 DSA-6017-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS haproxy 2.8.5-1ubuntu3.4 USN-7805-1
Ubuntu 22.04 LTS haproxy 2.4.24-0ubuntu0.22.04.3 USN-7805-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 haproxy 3.0.5-4.el10_1.1 RHSA-2025:21691
RHEL 9 haproxy 2.8.14-1.el9_7.1 RHSA-2025:21693
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS haproxy 3.0.5-4.el10_0.1 RHSA-2025:21692
RHEL 9.6 EUS haproxy 2.4.22-4.el9_6.1 RHSA-2025:21694
RHEL 9.4 EUS haproxy 2.4.22-3.el9_4.1 RHSA-2025:22399
RHEL 9.2 E4S haproxy 2.4.17-6.el9_2.3 RHSA-2025:22398
RHEL 9.0 E4S haproxy 2.4.7-2.el9_0.3 RHSA-2025:22422
Red Hat Hardened Images 1 haproxy 3.0.19-1.hum1 RHSA-2026:8729

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 haproxy 3.0.5-4.el10_1.1 ALSA-2025:21691
AlmaLinux 9 haproxy 2.8.14-1.el9_7.1 ALSA-2025:21693

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 haproxy 3.0.5-4.el10_1.1 RLSA-2025:21691
Rocky Linux 9 haproxy 2.8.14-1.el9_7.1 RLSA-2025:21693

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 haproxy 2.8.11+git0.01c1056a4-150600.3.9.1 SUSE-SU-2025:03587-1
SLES 15 SP6 haproxy 2.8.11+git0.01c1056a4-150600.3.9.1 SUSE-SU-2025:03587-1
SLES 15 SP5 haproxy 2.4.22+git0.f8e3218e2-150400.3.25.1 SUSE-SU-2025:03589-1
SLES 15 SP4 haproxy 2.4.22+git0.f8e3218e2-150400.3.25.1 SUSE-SU-2025:03589-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 haproxy 3.2.0+git0.e134140d2-160000.3.1 SUSE-SU-2026:20094-1
SLES 16.0 haproxy 3.2.0+git0.e134140d2-160000.3.1 SUSE-SU-2026:20092-1
SLE Micro 6.2 haproxy 3.2.0+git0.e134140d2-160000.3.1 SUSE-SU-2026:20109-1
SLE Micro 6.1 haproxy 2.8.11+git0.01c1056a4-slfo.1.1_2.1 SUSE-SU-2025:20900-1
SLE Micro 6.0 haproxy 2.8.11+git0.01c1056a4-2.1 SUSE-SU-2025:20872-1
SLE Micro 5.5 haproxy 2.4.22+git0.f8e3218e2-150400.3.25.1 SUSE-SU-2025:03589-1
SLE Micro 5.4 haproxy 2.4.22+git0.f8e3218e2-150400.3.25.1 SUSE-SU-2025:03589-1
SLE Micro 5.3 haproxy 2.4.22+git0.f8e3218e2-150400.3.25.1 SUSE-SU-2025:03589-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed haproxy 3.2.6+git0.81568b2d1-1.1 openSUSE-SU-2025:15599-1
openSUSE Leap 16.0 haproxy 3.2.0+git0.e134140d2-160000.3.1 openSUSE-SU-2026:20032-1
openSUSE Leap 15.6 haproxy 2.8.11+git0.01c1056a4-150600.3.9.1 SUSE-SU-2025:03587-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 haproxy 2.9.11-4 —
Azure Linux 2 (CBL-Mariner) haproxy 2.4.24-2 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 haproxy 3.0.5-4.el10_1.1 ELSA-2025-21691
Oracle Linux 9 haproxy 2.8.14-1.el9_7.1 ELSA-2025-21693

Advisories 26

References