CVE-2025-11230

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

• haproxy aloha appliance (>= 14.5.0 < 14.5.33) • haproxy aloha appliance (>= 15.5.0 < 15.5.28) • haproxy aloha appliance (>= 16.5.0 < 16.5.19) • haproxy aloha appliance (>= 17.0.0 < 17.0.7) • haproxy haproxy (>= 2.4.0 < 2.4.30) • haproxy haproxy (>= 2.6.0 < 2.6.23) • haproxy haproxy (>= 2.8.0 < 2.8.16) • haproxy haproxy (>= 3.0.0 < 3.0.12) • haproxy haproxy (>= 3.1.0 < 3.1.9) • haproxy haproxy (>= 3.2.0 < 3.2.6) • haproxy haproxy enterprise 2.4r1 • haproxy haproxy enterprise 2.6r1 • haproxy haproxy enterprise 2.8r1 • haproxy haproxy enterprise 3.0r1 • haproxy haproxy enterprise 3.1r1 • haproxy kubernetes ingress controller (< 1.9.14-ee7) • haproxy kubernetes ingress controller (< 3.1.12) • haproxy kubernetes ingress controller (>= 1.10.10-ee1 < 1.11.12-ee10) • haproxy kubernetes ingress controller (>= 3.0.0-ee1 < 3.0.15-ee4)