CVE-2025-11230— Denial of service vulnerability in HAProxy mjson library
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-11230
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial of service vulnerability in HAProxy mjson library
Source: NVD (National Vulnerability Database)
Vulnerability Description
Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
算法复杂性
Source: NVD (National Vulnerability Database)
Vulnerability Title
HAProxy 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HAProxy是法国HAProxy公司的一款开源的TCP/HTTP负载均衡服务器。该服务器提供4层、7层代理，并能支持上万级别的连接，具有高效、稳定等特点。 HAProxy存在安全漏洞，该漏洞源于mjson中算法复杂度低效，可能导致拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HAProxy Technologies | HAProxy Community Edition | 2.4.0 ~ 2.4.30 | - |
II. Public POCs for CVE-2025-11230
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-11230
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: HAProxy Technologies
Same weakness: CWE-407
- CVE-2026-45186
libexpat<2.8.1 XML输入拒绝服务漏洞 - CVE-2026-42245
net-imap: Quadratic complexity when reading response literal - CVE-2026-43967
Quadratic fragment-name uniqueness check causes denial of se - CVE-2026-40476
graphql-php: Denial of Service via quadratic complexity in O - CVE-2026-35599
Vikunja has an Algorithmic Complexity DoS in Repeating Task
V. Comments for CVE-2025-11230
No comments yet