CVE-2025-11230

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-407

Affected software

VendorProductVersions
HAProxy TechnologiesHAProxy Community Edition>= 2.4.0, < 2.4.30; >= 2.6.0, < 2.6.23; >= 2.8.0, < 2.8.16; >= 3.0.0, < 3.0.12; >= 3.1.0, < 3.1.9; >= 3.2.0, < 3.2.6

References

Timeline

Published
Nov 19, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-112327.5To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, wCVE-2025-112336.3Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, cauCVE-2025-112347.5A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This caCVE-2025-112357.5Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from CVE-2025-112375.3The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAXCVE-2025-112387.2The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer header in versions less than, or equal CVE-2025-112394.3Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting witCVE-2025-112407.2An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link CVE-2025-112416.4The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used CVE-2025-112429.8Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik allows CVE-2025-112438.3Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM (before v1.6) allows Excessive Allocation via network.CVE-2025-112443.7The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and includi
CVE-2025-11230: High severity, CVSS 7.5 | Vulnix