CVE-2025-11230

A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the json_query or jwt_payload_query function

This vulnerability is rated as Important severity because unauthenticated remote attackers can trigger excessive CPU consumption and cause a denial of service by sending specially crafted JSON payloads. Red Hat default deployments of HAProxy do not parse JSON or JWT content in incoming requests. The issue only affects environments that explicitly configure HAProxy to evaluate JSON data using sample fetch methods such as json_query or jwt_payload_query.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.