Bug 2413003 (CVE-2025-11230) - CVE-2025-11230 haproxy: denial of service vulnerability in HAProxy mjson library
Summary: CVE-2025-11230 haproxy: denial of service vulnerability in HAProxy mjson library
Keywords:
Status: NEW
Alias: CVE-2025-11230
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2413005 2413006 2413007 2413008
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-11-06 03:17 UTC by OSIDB Bzimport
Modified: 2025-11-18 08:47 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-11-06 03:17:02 UTC 
A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the json_query or jwt_payload_query function
Note You need to log in before you can comment on or make changes to this bug.