Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000538 advisory.

    Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service     via specially crafted JSON requests.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20032-1 advisory.

    - CVE-2025-11230: issue in the mjson JSON decoder leads to excessive resource consumption when processing     numbers with       large exponents (bsc#1250983).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service     via specially crafted JSON requests.(CVE-2025-11230)

Tenable has extracted the preceding description block directly from the EulerOS haproxy security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2025-11521:04 advisory.

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-21691 advisory.

    [3.0.5-4.1]
    - Fix denial of service vulnerability in mjson library (CVE-2025-11230)       Resolves: RHEL-126652

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:21693 advisory.

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:22398 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:22422 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:22399 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-21693 advisory.

    [2.8.14-1.1]
    - Fix denial of service vulnerability in mjson library (CVE-2025-11230)       Resolves: RHEL-126664

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:21691 advisory.

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:21691 advisory.

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0186 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-11230:
    Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service     via specially crafted JSON requests.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:21693 advisory.

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:21691 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:21692 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:21694 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:21693 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:03587-1 advisory.

    - CVE-2025-11230: Fixed issue in the mjson JSON decoder, that could have let to excessive       resource consumption when processing numbers with large exponents (bsc#1250983).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:03589-1 advisory.

    - CVE-2025-11230: Fixed issue in the mjson JSON decoder, that could have let to excessive       resource consumption when processing numbers with large exponents (bsc#1250983).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7805-1 advisory.

    Oula Kivalo discovered that HAProxy incorrectly handled parsing certain json numbers. A remote attacker     could possibly use this issue to cause HAProxy to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6017 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6017-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     October 03, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : haproxy     CVE ID         : CVE-2025-11230

    Oula Kivalo reported that HAProxy, a fast and reliable load balancing     reverse proxy, is prone to a denial of service vulnerability when     parsing JSON numbers.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 2.6.12-1+deb12u3.

    For the stable distribution (trixie), this problem has been fixed in     version 3.0.11-1+deb13u1.

    We recommend that you upgrade your haproxy packages.

    For the detailed security status of haproxy please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/haproxy

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
290383	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: haproxy (UTSA-2026-000538)	Nessus	Unity Linux Local Security Checks	high
287969	openSUSE 16 Security Update : haproxy (openSUSE-SU-2026:20032-1)	Nessus	SuSE Local Security Checks	high
284738	EulerOS 2.0 SP12 : haproxy (EulerOS-SA-2026-1089)	Nessus	Huawei Local Security Checks	high
284725	EulerOS 2.0 SP12 : haproxy (EulerOS-SA-2026-1069)	Nessus	Huawei Local Security Checks	high
282760	MiracleLinux 9 : haproxy-2.8.14-1.el9_7.1 (AXSA:2025-11521:04)	Nessus	Miracle Linux Local Security Checks	medium
277407	Oracle Linux 10 : haproxy (ELSA-2025-21691)	Nessus	Oracle Linux Local Security Checks	high
277157	RockyLinux 9 : haproxy (RLSA-2025:21693)	Nessus	Rocky Linux Local Security Checks	high
277063	RHEL 9 : haproxy (RHSA-2025:22398)	Nessus	Red Hat Local Security Checks	high
276947	RHEL 9 : haproxy (RHSA-2025:22422)	Nessus	Red Hat Local Security Checks	high
276934	RHEL 9 : haproxy (RHSA-2025:22399)	Nessus	Red Hat Local Security Checks	high
276899	Oracle Linux 9 : haproxy (ELSA-2025-21693)	Nessus	Oracle Linux Local Security Checks	high
276756	AlmaLinux 10 : haproxy (ALSA-2025:21691)	Nessus	Alma Linux Local Security Checks	high
276740	RockyLinux 10 : haproxy (RLSA-2025:21691)	Nessus	Rocky Linux Local Security Checks	high
276529	Alibaba Cloud Linux 3 : 0186: haproxy (ALINUX3-SA-2025:0186)	Nessus	Alibaba Cloud Linux Local Security Checks	high
275803	AlmaLinux 9 : haproxy (ALSA-2025:21693)	Nessus	Alma Linux Local Security Checks	high
275711	RHEL 10 : haproxy (RHSA-2025:21691)	Nessus	Red Hat Local Security Checks	high
275710	RHEL 10 : haproxy (RHSA-2025:21692)	Nessus	Red Hat Local Security Checks	high
275707	RHEL 9 : haproxy (RHSA-2025:21694)	Nessus	Red Hat Local Security Checks	high
275706	RHEL 9 : haproxy (RHSA-2025:21693)	Nessus	Red Hat Local Security Checks	high
270323	SUSE SLES15 / openSUSE 15 Security Update : haproxy (SUSE-SU-2025:03587-1)	Nessus	SuSE Local Security Checks	medium
270301	SUSE SLES15 Security Update : haproxy (SUSE-SU-2025:03589-1)	Nessus	SuSE Local Security Checks	medium
269469	Linux Distros Unpatched Vulnerability : CVE-2025-11230	Nessus	Misc.	high
267929	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 : HAProxy vulnerability (USN-7805-1)	Nessus	Ubuntu Local Security Checks	high
266463	Debian dsa-6017 : haproxy - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2025-11230

high

Tenable Plugins

high

high

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

high

high

high