High severity · published Nov 19, 2025
CVE-2025-11230
Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Aloha Appliance · Haproxy
14.5.0 before 14.5.33; 15.5.0 before 15.5.28; 16.5.0 before 16.5.19; 17.0.0 before 17.0.7 · source: NVD
HA
Haproxy · Haproxy
2.4.0 before 2.4.30; 2.6.0 before 2.6.23; 2.8.0 before 2.8.16; 3.0.0 before 3.0.12; 3.1.0 before 3.1.9; 3.2.0 before 3.2.6 · source: NVD
HE
Haproxy Enterprise · Haproxy
2.4r1; 2.4r1; 2.4r1; 2.4r1; 2.4r1; 2.4r1; +34 more · source: NVD
KI
Kubernetes Ingress Controller · Haproxy
before 1.9.14-ee7; before 3.1.12; 1.10.10-ee1 before 1.11.12-ee10; 3.0.0-ee1 before 3.0.15-ee4 · source: NVD