Denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

Summary

Denial of service vulnerability in HAProxy mjson library

Original description

The description as published by the source.

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami haproxy

[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.30"},{"introduced":"2.6.0"},{"fixed":"2.6.23"},{"introduced":"2.8.0"},{"fixed":"2.8.16"},{"introduced":"3.0.0"},{"fixed":"3.0.12"},{"introduced":"3.1.0"},{"fixed":"3.1.9"},{"introduced":"3.2.0"},{"fixed":"3.2.6"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2025-11230 haproxy Fixed in: 2.6.12-1+deb12u3

References

advisory haproxy.com
web nvd.nist.gov