7.5

CVE-2025-11230: haproxy technologies haproxy community edition Inefficient Algorithmic Complexity

CVSS: 7.5v3.1HighAnalyzed
AliasesMGASA-2025-0242SUSE-SU-2025:03587-1SUSE-SU-2025:03589-1
Published 19-11-2025Last modified 19-11-2025
Open JSON

Vulnerability summary

CVE-2025-11230 is a high (CVSS 7.5) Inefficient Algorithmic Complexity vulnerability in haproxy technologies haproxy community edition. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 54% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.74%
0%100%
Low · +0.05 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-58MP-CC8X-V99GCGA-G657-HJMH-7PG6

Timeline

  1. 19-11-2025
    PublishedVulnerability first disclosed.
  2. 19-11-2025
    Last modifiedVulnerability information updated.

Description

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.74%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

+0.05 pp

From 0.69% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.74%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse12 products
  • haproxy&distro=SUSE Linux Enterprise High Availability Extension 15 SP4< 2.4.22+git0.f8e3218e2-150400.3.25.1
  • haproxy&distro=SUSE Linux Enterprise High Availability Extension 15 SP5< 2.4.22+git0.f8e3218e2-150400.3.25.1
  • haproxy&distro=SUSE Linux Enterprise High Availability Extension 15 SP6< 2.8.11+git0.01c1056a4-150600.3.9.1
  • haproxy&distro=SUSE Linux Enterprise High Availability Extension 15 SP7< 2.8.11+git0.01c1056a4-150600.3.9.1
  • haproxy&distro=SUSE Linux Enterprise High Availability Extension 16.0< 3.2.0+git0.e134140d2-160000.3.1
Haproxy4 products
  • aloha_appliance≥ 14.5.0, < 14.5.33 | ≥ 15.5.0, < 15.5.28 | ≥ 16.5.0, < 16.5.19 | ≥ 17.0.0, < 17.0.7
  • haproxy≥ 2.4.0, < 2.4.30 | ≥ 2.6.0, < 2.6.23 | ≥ 2.8.0, < 2.8.16 | ≥ 3.0.0, < 3.0.12 | ≥ 3.1.0, < 3.1.9 | ≥ 3.2.0, < 3.2.6
  • haproxy_enterprise2.4r1:1.0.0-253.271 | 2.4r1:1.0.0-254.271 | 2.4r1:1.0.0-259.342 | 2.4r1:1.0.0-263.343 | 2.4r1:1.0.0-264.356 | 2.4r1:1.0.0-268.356 | 2.4r1:1.0.0-268.373 | 2.4r1:1.0.0-268.459 | 2.4r1:1.0.0-268.464 | 2.4r1:1.0.0-268.477 | 2.4r1:1.0.0-268.499 | 2.4r1:1.0.0-268.553 | 2.4r1:1.0.0-268.560 | 2.4r1:1.0.0-268.564 | 2.4r1:1.0.0-268.596 | 2.4r1:1.0.0-269.596 | 2.4r1:1.0.0-269.599 | 2.4r1:1.0.0-270.616 | 2.4r1:1.0.0-271.673 | 2.4r1:1.0.0-271.677 | 2.4r1:1.0.0-272.683 | 2.4r1:1.0.0-272.686 | 2.4r1:1.0.0-272.728 | 2.4r1:1.0.0-274.752 | 2.4r1:1.0.0-276.752 | 2.4r1:1.0.0-277.814 | 2.4r1:1.0.0-277.831 | 2.4r1:1.0.0-278.838 | 2.4r1:1.0.0-279.852 | 2.4r1:1.0.0-279.859 | 2.4r1:1.0.0-279.877 | 2.4r1:1.0.0-279.911 | 2.4r1:1.0.0-279.940 | 2.4r1:1.0.0-279.952 | 2.4r1:1.0.0-279.953 | 2.4r1:1.0.0-279.956 | 2.4r1:1.0.0-280.956 | 2.4r1:1.0.0-282.998 | 2.4r1:1.0.0-282.999 | 2.4r1:1.0.0-284.999 | 2.4r1:1.0.0-285.1010 | 2.4r1:1.0.0-286.1064 | 2.4r1:1.0.0-286.1068 | 2.4r1:1.0.0-286.1089 | 2.4r1:1.0.0-286.1094 | 2.4r1:1.0.0-288.1094 | 2.4r1:1.0.0-288.1158 | 2.4r1:1.0.0-288.1167 | 2.4r1:1.0.0-288.1189 | 2.4r1:1.0.0-289.1189 | 2.4r1:1.0.0-290.1239 | 2.4r1:1.0.0-291.1246 | 2.4r1:1.0.0-292.1293 | 2.4r1:1.0.0-294.1346 | 2.4r1:1.0.0-294.1364 | 2.4r1:1.0.0-294.1376 | 2.4r1:1.0.0-294.1377 | 2.4r1:1.0.0-294.1442 | 2.6r1:1.0.0-281.466 | 2.6r1:1.0.0-282.561 | 2.6r1:1.0.0-283.562 | 2.6r1:1.0.0-283.565 | 2.6r1:1.0.0-283.616 | 2.6r1:1.0.0-283.632 | 2.6r1:1.0.0-283.633 | 2.6r1:1.0.0-283.636 | 2.6r1:1.0.0-284.636 | 2.6r1:1.0.0-285.726 | 2.6r1:1.0.0-285.727 | 2.6r1:1.0.0-287.727 | 2.6r1:1.0.0-288.770 | 2.6r1:1.0.0-288.773 | 2.6r1:1.0.0-288.848 | 2.6r1:1.0.0-288.849 | 2.6r1:1.0.0-289.1020 | 2.6r1:1.0.0-289.1028 | 2.6r1:1.0.0-289.1041 | 2.6r1:1.0.0-289.873 | 2.6r1:1.0.0-289.975 | 2.6r1:1.0.0-289.976 | 2.6r1:1.0.0-291.1046 | 2.6r1:1.0.0-292.1046 | 2.6r1:1.0.0-292.1055 | 2.6r1:1.0.0-292.1120 | 2.6r1:1.0.0-292.1147 | 2.6r1:1.0.0-292.1148 | 2.6r1:1.0.0-292.1156 | 2.6r1:1.0.0-292.1181 | 2.6r1:1.0.0-292.1187 | 2.6r1:1.0.0-293.1189 | 2.6r1:1.0.0-293.1190 | 2.6r1:1.0.0-294.1212 | 2.6r1:1.0.0-294.1285 | 2.6r1:1.0.0-295.1303 | 2.6r1:1.0.0-296.1392 | 2.6r1:1.0.0-296.1416 | 2.6r1:1.0.0-299.1416 | 2.6r1:1.0.0-299.1474 | 2.6r1:1.0.0-299.1487 | 2.6r1:1.0.0-299.1511 | 2.6r1:1.0.0-299.1542 | 2.6r1:1.0.0-299.1557 | 2.6r1:1.0.0-299.1596 | 2.6r1:1.0.0-299.1603 | 2.6r1:1.0.0-299.1606 | 2.6r1:1.0.0-299.1618 | 2.6r1:1.0.0-300.1666 | 2.6r1:1.0.0-301.1666 | 2.8r1:1.0.0-302.234 | 2.8r1:1.0.0-304.266 | 2.8r1:1.0.0-305.279 | 2.8r1:1.0.0-305.285 | 2.8r1:1.0.0-306.288 | 2.8r1:1.0.0-306.289 | 2.8r1:1.0.0-307.317 | 2.8r1:1.0.0-310.350 | 2.8r1:1.0.0-310.364 | 2.8r1:1.0.0-310.373 | 2.8r1:1.0.0-310.374 | 2.8r1:1.0.0-310.418 | 2.8r1:1.0.0-310.422 | 2.8r1:1.0.0-310.424 | 2.8r1:1.0.0-311.449 | 2.8r1:1.0.0-311.452 | 2.8r1:1.0.0-311.453 | 2.8r1:1.0.0-312.592 | 2.8r1:1.0.0-312.613 | 2.8r1:1.0.0-317.613 | 2.8r1:1.0.0-318.674 | 2.8r1:1.0.0-319.699 | 2.8r1:1.0.0-319.723 | 2.8r1:1.0.0-320.750 | 2.8r1:1.0.0-320.761 | 2.8r1:1.0.0-320.770 | 2.8r1:1.0.0-320.780 | 2.8r1:1.0.0-320.781 | 2.8r1:1.0.0-320.783 | 2.8r1:1.0.0-320.831 | 2.8r1:1.0.0-320.851 | 2.8r1:1.0.0-320.853 | 2.8r1:1.0.0-320.895 | 2.8r1:1.0.0-321.895 | 2.8r1:1.0.0-321.901 | 2.8r1:1.0.0-321.919 | 2.8r1:1.0.0-321.931 | 2.8r1:1.0.0-321.934 | 2.8r1:1.0.0-321.937 | 2.8r1:1.0.0-322.942 | 2.8r1:1.0.0-324.1030 | 2.8r1:1.0.0-324.1071 | 2.8r1:1.0.0-324.1072 | 2.8r1:1.0.0-324.947 | 2.8r1:1.0.0-326.1073 | 3.0r1:1.0.0-337.363 | 3.0r1:1.0.0-337.390 | 3.0r1:1.0.0-337.394 | 3.0r1:1.0.0-339.395 | 3.0r1:1.0.0-339.405 | 3.0r1:1.0.0-339.415 | 3.0r1:1.0.0-339.455 | 3.0r1:1.0.0-339.466 | 3.0r1:1.0.0-339.471 | 3.0r1:1.0.0-341.475 | 3.0r1:1.0.0-342.482 | 3.0r1:1.0.0-344.495 | 3.0r1:1.0.0-344.503 | 3.0r1:1.0.0-344.561 | 3.0r1:1.0.0-344.564 | 3.0r1:1.0.0-344.591 | 3.0r1:1.0.0-344.608 | 3.0r1:1.0.0-344.641 | 3.0r1:1.0.0-344.655 | 3.0r1:1.0.0-344.672 | 3.0r1:1.0.0-345.673 | 3.0r1:1.0.0-346.792 | 3.1r1:1.0.0-345.233 | 3.1r1:1.0.0-346.274 | 3.1r1:1.0.0-346.287 | 3.1r1:1.0.0-347.299 | 3.1r1:1.0.0-347.338 | 3.1r1:1.0.0-347.362 | 3.1r1:1.0.0-347.405 | 3.1r1:1.0.0-347.419 | 3.1r1:1.0.0-347.431 | 3.1r1:1.0.0-347.449 | 3.1r1:1.0.0-348.519
  • kubernetes_ingress_controller< 1.9.14-ee7 | < 3.1.12 | ≥ 1.10.10-ee1, < 1.11.12-ee10 | ≥ 3.0.0-ee1, < 3.0.15-ee4
Chainguard3 products
  • haproxy-2.4< 2.4.30-r0
  • haproxy-2.6< 2.6.23-r0
  • haproxy-2.8< 2.8.18-r0
Opensuse3 products
  • haproxy&distro=openSUSE Leap 15.6< 2.8.11+git0.01c1056a4-150600.3.9.1
  • haproxy&distro=openSUSE Leap 16.0< 3.2.0+git0.e134140d2-160000.3.1
  • haproxy&distro=openSUSE Tumbleweed< 3.2.6+git0.81568b2d1-1.1
Redhat3 products
  • haproxy< 0:3.0.5-4.el10_1.1 | < 0:3.0.5-4.el10_0.1 | < 0:2.8.14-1.el9_7.1 | < 0:2.4.22-4.el9_6.1 | < 0:2.4.17-6.el9_2.3 | < 0:2.4.22-3.el9_4.1 | < 0:2.4.7-2.el9_0.3 | < 0:3.0.19-1.hum1
  • haproxy-debuginfo< 0:3.0.5-4.el10_1.1 | < 0:3.0.5-4.el10_0.1 | < 0:2.8.14-1.el9_7.1 | < 0:2.4.22-4.el9_6.1 | < 0:2.4.17-6.el9_2.3 | < 0:2.4.22-3.el9_4.1 | < 0:2.4.7-2.el9_0.3
  • haproxy-debugsource< 0:3.0.5-4.el10_1.1 | < 0:3.0.5-4.el10_0.1 | < 0:2.8.14-1.el9_7.1 | < 0:2.4.22-4.el9_6.1 | < 0:2.4.17-6.el9_2.3 | < 0:2.4.22-3.el9_4.1 | < 0:2.4.7-2.el9_0.3
Debian1 product
  • haproxy< 3.2.5-2 | < 2.6.12-1+deb12u3 | < 3.0.11-1+deb13u1
Haproxy technologies1 product
  • haproxy community edition≥ 2.4.0, < 2.4.30 | ≥ 2.6.0, < 2.6.23 | ≥ 2.8.0, < 2.8.16 | ≥ 3.0.0, < 3.0.12 | ≥ 3.1.0, < 3.1.9 | ≥ 3.2.0, < 3.2.6
Mageia1 product
  • haproxy< 2.8.16-1.mga9
Ubuntu1 product
  • haproxy< 2.4.24-0ubuntu0.22.04.3 | < 2.8.5-1ubuntu3.4

9 vendors · 29 products

References

41 links
Show all 41 references