CVE-2025-11230CWE-407

CVE-2025-11230

High Β· published November 19, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

⚑ A crafty JSON request can turn HAProxy into a sluggish sloth! πŸŽ‰ Let’s break down the efficient algorithm complexity issue at play here. Think of it like a busy restaurant where a few diners keep ordering the most complicated dishes β€” the kitchen gets overwhelmed, and service slows to a crawl. The inefficient algorithm in HAProxy is like that kitchen, struggling under the weight of overly complex requests. If exploited, attackers could bombard your server with these specially crafted JSON requests, causing a denial of service that brings your application to a screeching halt. Your users will experience frustrating downtime, which could lead to loss of trust and business. That’s absolutely devastating!

Put simply

Think of it like a busy restaurant where a few diners keep ordering the most complicated dishes β€” the kitchen gets overwhelmed, and service slows to a crawl. The inefficient algorithm in HAProxy is like that kitchen, struggling under the weight of overly complex requests. This vulnerability arises from inefficient algorithm complexity in the mjson module of HAProxy, allowing attackers to send customized JSON requests that exploit this inefficiency, leading to resource exhaustion and service slowdown.

What to do

If exploited, attackers could bombard your server with these specially crafted JSON requests, causing a denial of service that brings your application to a screeching halt. Your users will experience frustrating downtime, which could lead to loss of trust and business. That’s absolutely devastating! To mitigate this issue, update HAProxy to the latest version as soon as possible. Additionally, implement rate limiting on incoming requests to prevent abuse, and monitor your logs for unusual activity that may indicate an ongoing attack. Don't let your service suffer! You've got this! Follow these steps, and you'll keep your application running smoothly and securely! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
7.5 Β· HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00740 Β· 54.1th percentile
Weakness
CWE-407 Β· Inefficient Algorithmic Complexity
Published
2025-11-19T15:15Z
Affected products (200)
ProductVersionsFixed in
haproxy/aloha_applianceβ‰₯ 14.5.0, < 14.5.3314.5.33
haproxy/aloha_applianceβ‰₯ 15.5.0, < 15.5.2815.5.28
haproxy/aloha_applianceβ‰₯ 16.5.0, < 16.5.1916.5.19
haproxy/aloha_applianceβ‰₯ 17.0.0, < 17.0.717.0.7
haproxy/haproxyβ‰₯ 2.4.0, < 2.4.302.4.30
haproxy/haproxyβ‰₯ 2.6.0, < 2.6.232.6.23
haproxy/haproxyβ‰₯ 2.8.0, < 2.8.162.8.16
haproxy/haproxyβ‰₯ 3.0.0, < 3.0.123.0.12
haproxy/haproxyβ‰₯ 3.1.0, < 3.1.93.1.9
haproxy/haproxyβ‰₯ 3.2.0, < 3.2.63.2.6
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/haproxy_enterpriseall versionsβ€”
haproxy/kubernetes_ingress_controller< 1.9.14-ee71.9.14-ee7
haproxy/kubernetes_ingress_controller< 3.1.123.1.12
haproxy/kubernetes_ingress_controllerβ‰₯ 1.10.10-ee1, < 1.11.12-ee101.11.12-ee10
haproxy/kubernetes_ingress_controllerβ‰₯ 3.0.0-ee1, < 3.0.15-ee43.0.15-ee4
References (1)
EPSS history
Timeline
  • 19 NOV 09:28Z
    Denial of service vulnerability in HAProxy mjson library
    cvelistv5